Curl 7.75.0 < 8.22.0 SigV4 Header Leak

The version of curl installed on the remote host is 7.75.0 prior to 8.22.0. It is, therefore, affected by an information disclosure vulnerability: - Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the...

AZL-110160 CVE-2026-86409 affecting package rust 1.75.0-31

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

CVE-2026-86409

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

AZL-109956 CVE-2026-86409 affecting package curl 8.11.1-12

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

ALPINE-CVE-2026-86409

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

AZL-110256 CVE-2026-86409 affecting package rust 1.96.1-2

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

AZL-109914 CVE-2026-86409 affecting package cmake 3.30.3-15

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

DEBIAN-CVE-2026-86409

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

AZL-110283 CVE-2026-86409 affecting package tensorflow 2.16.1-11

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

AZL-110010 CVE-2026-86409 affecting package mysql 8.0.46-2

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

CVE-2026-86409

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

CVE-2026-86409 stale SigV4 headers sent unintended

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

CVE-2026-86409 stale SigV4 headers sent unintended

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

EUVD-2026-105274

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

CVE-2026-86409

The curl library (versions prior to 8.22.0 ) is vulnerable to an information disclosure flaw where setting CURLOPT_AWS_SIGV4 to NULL fails to disable SigV4 authentication. Consequently, a subsequent transfer using the same handle will continue to send an Authorization: AWS4-HMAC-SHA256 header to ...

CVE-2026-86409

Setting "CURLOPTAWSSIGV4" to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an "Authorization: AWS4-HMAC-SHA256" header to whatever URL isset next, leaking state information...

CVE-2026-86409

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

curl information leakage vulnerability

The curl version 7.75.0 to 8.21.0 has a vulnerability related to information leakage. This vulnerability arises when CURLOPTAWSSIGV4 is set to NULL without disabling SigV4 authentication. As a result, the same request’s subsequent transmissions still send the Authorization: AWS4-HMAC-SHA256 heade...

SUSE CVE-2026-86409

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

stale SigV4 headers sent unintended

Setting CURLOPTAWSSIGV4 to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL is set next, leaking state information...