Bug 2550378 (CVE-2026-86409)

Summary:	CVE-2026-86409 curl: curl: stale SigV4 headers sent unintended
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	anthomas, csutherl, ehelms, ggainey, jclere, jpasqual, juwatts, lblicha, mdellweg, mhulan, nmoumoul, ogajduse, osousa, pcreech, pjindal, plodge, rchan, rekumar, rhel-process-autobot, security-response-team, smallamp, szappis, tmalecek, vchlup, vvoronko, watson-tool-maintainers, zhunting
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in curl. When an application attempts to disable Amazon Web Services Signature Version 4 (AWS SigV4) authentication on a reused connection handle, curl fails to clear the setting as expected. If the application subsequently directs a request to an untrusted or attacker-controlled server using the same handle, curl unintentionally transmits the signed authorization header. This flaw allows a remote attacker to obtain access key identifiers and request signatures, leading to information disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-10-14

Description OSIDB Bzimport 2026-10-13 12:11:18 UTC

stale SigV4 headers sent unintended
===================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-86409.html)

VULNERABILITY
-------------

Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,
contrary to expectations and documentation. A subsequent transfer on the same
handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL
is set next, leaking state information.

INFO
----

An application that reuses an easy handle, retains `CURLOPT_USERPWD`
credentials, relies on the documented NULL reset, and then performs a request
to an attacker-influenced URL will unintentionally send a signed SigV4
`Authorization:` header to that destination. The header exposes the access-key
identifier and a request-bound signature. The secret key is not transmitted.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-86409 to this issue.

CWE-201: Information Exposure Through Sent Data

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 7.75.0 to and including 8.21.0
- Not affected versions: curl < 7.75.0 and >= 8.22.0
- Introduced-in: https://github.com/curl/curl/commit/08e8455dddc5e48e58a12ade3

libcurl is used by many applications, but not always advertised as such!

This flaw is not accessible using the curl command line tool.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/c3c70440e8d9938c0bb732595751e8

RECOMMENDATIONS
---------------

 A - Upgrade curl to version 8.22.0

 B - Apply the patch to your local version

 C - Make sure no attempts to NULL this option is done

TIMELINE
--------

This issue was reported to the curl project on August 27, 2026.

curl 8.22.0 was released on September 2, 2026. This advisory was published on
October 14, 2026.

CREDITS
-------

- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Viktor Szakats

Thanks a lot!