CVE-2026-9546

HIGH 7.5

sending old referer

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.

CWE	CWE-200
Vendor	curl
Product	curl
Published	Jul 3, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for curl curl

Be the first to know when new high vulnerabilities affecting curl curl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

curl / curl

8.18.0 < 8.20.1

curl / curl

2cb868242dc2ac9cd52ee64987ef51d5964a56f9 < 862e8a74a84478d82973471b4f49dc2746c1780e

curl / curl

8.20.0 8.19.0 8.18.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

curl.se: https://curl.se/docs/CVE-2026-9546.json curl.se: https://curl.se/docs/CVE-2026-9546.html hackerone.com: https://hackerone.com/reports/3754343

Credits

renjian on hackerone Daniel Stenberg