EUVD-2026-105274

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

UBUNTU-CVE-2026-86409

Setting CURLOPTAWSSIGV4 to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL is set next, leaking state information...