CVE-2026-9546

A vulnerability in libcurl causes the HTTP Referer: header to persist even when explicitly cleared by setting CURLOPT_REFERER to NULL. The root cause is a failure to clear the internal state, where data->state.referer retains a dangling pointer. This leads to a heap-use-after-free and allows s...

CVE-2026-9079

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them...

CVE-2026-9079

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them...