# CVE-2026-11856

## Summary

- **CVE ID:** CVE-2026-11856
- **Severity:** CRITICAL
- **CVSS Score:** 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** CWE-294
- **Published:** Jul 3, 2026
- **Last Modified:** Sep 17, 2026

## Description

Successfully using libcurl to do a transfer to a specific HTTP origin
(`hostA`) with **Digest** authentication and then changing the origin to a
different one (`hostB`) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the  `Authorization:` header field meant for `hostA`,
to `hostB`.

## Affected Products

- curl — curl (8.20.0)
- curl — curl (8.19.0)
- curl — curl (8.18.0)
- curl — curl (8.17.0)
- curl — curl (8.16.0)
- curl — curl (8.15.0)
- curl — curl (8.14.1)
- curl — curl (8.14.0)
- curl — curl (8.13.0)
- curl — curl (8.12.1)
- curl — curl (8.12.0)
- curl — curl (8.11.1)
- curl — curl (8.11.0)
- curl — curl (8.10.1)
- curl — curl (8.10.0)
- curl — curl (8.9.1)
- curl — curl (8.9.0)
- curl — curl (8.8.0)
- curl — curl (8.7.1)
- curl — curl (8.7.0)
- curl — curl (8.6.0)
- curl — curl (8.5.0)
- curl — curl (8.4.0)
- curl — curl (8.3.0)
- curl — curl (8.2.1)
- curl — curl (8.2.0)
- curl — curl (8.1.2)
- curl — curl (8.1.1)
- curl — curl (8.1.0)
- curl — curl (8.0.1)
- curl — curl (8.0.0)
- curl — curl (7.88.1)
- curl — curl (7.88.0)
- curl — curl (7.87.0)
- curl — curl (7.86.0)
- curl — curl (7.85.0)
- curl — curl (7.84.0)
- curl — curl (7.83.1)
- curl — curl (7.83.0)
- curl — curl (7.82.0)
- curl — curl (7.81.0)
- curl — curl (7.80.0)
- curl — curl (7.79.1)
- curl — curl (7.79.0)
- curl — curl (7.78.0)
- curl — curl (7.77.0)
- curl — curl (7.76.1)
- curl — curl (7.76.0)
- curl — curl (7.75.0)
- curl — curl (7.74.0)
- curl — curl (7.73.0)
- curl — curl (7.72.0)
- curl — curl (7.71.1)
- curl — curl (7.71.0)
- curl — curl (7.70.0)
- curl — curl (7.69.1)
- curl — curl (7.69.0)
- curl — curl (7.68.0)
- curl — curl (7.67.0)
- curl — curl (7.66.0)
- curl — curl (7.65.3)
- curl — curl (7.65.2)
- curl — curl (7.65.1)
- curl — curl (7.65.0)
- curl — curl (7.64.1)
- curl — curl (7.64.0)
- curl — curl (7.63.0)
- curl — curl (7.62.0)
- curl — curl (7.61.1)
- curl — curl (7.61.0)
- curl — curl (7.60.0)
- curl — curl (7.59.0)
- curl — curl (7.58.0)
- curl — curl (7.57.0)
- curl — curl (7.56.1)
- curl — curl (7.56.0)
- curl — curl (7.55.1)
- curl — curl (7.55.0)
- curl — curl (7.54.1)
- curl — curl (7.54.0)
- curl — curl (7.53.1)
- curl — curl (7.53.0)
- curl — curl (7.52.1)
- curl — curl (7.52.0)
- curl — curl (7.51.0)
- curl — curl (7.50.3)
- curl — curl (7.50.2)
- curl — curl (7.50.1)
- curl — curl (7.50.0)
- curl — curl (7.49.1)
- curl — curl (7.49.0)
- curl — curl (7.48.0)
- curl — curl (7.47.1)
- curl — curl (7.47.0)
- curl — curl (7.46.0)
- curl — curl (7.45.0)
- curl — curl (7.44.0)
- curl — curl (7.43.0)
- curl — curl (7.42.1)
- curl — curl (7.42.0)
- curl — curl (7.41.0)
- curl — curl (7.40.0)
- curl — curl (7.39.0)
- curl — curl (7.38.0)
- curl — curl (7.37.1)
- curl — curl (7.37.0)
- curl — curl (7.36.0)
- curl — curl (7.35.0)
- curl — curl (7.34.0)
- curl — curl (7.33.0)
- curl — curl (7.32.0)
- curl — curl (7.31.0)
- curl — curl (7.30.0)
- curl — curl (7.29.0)
- curl — curl (7.28.1)
- curl — curl (7.28.0)
- curl — curl (7.27.0)
- curl — curl (7.26.0)
- curl — curl (7.25.0)
- curl — curl (7.24.0)
- curl — curl (7.23.1)
- curl — curl (7.23.0)
- curl — curl (7.22.0)
- curl — curl (7.21.7)
- curl — curl (7.21.6)
- curl — curl (7.21.5)
- curl — curl (7.21.4)
- curl — curl (7.21.3)
- curl — curl (7.21.2)
- curl — curl (7.21.1)
- curl — curl (7.21.0)
- curl — curl (7.20.1)
- curl — curl (7.20.0)
- curl — curl (7.19.7)
- curl — curl (7.19.6)
- curl — curl (7.19.5)
- curl — curl (7.19.4)
- curl — curl (7.19.3)
- curl — curl (7.19.2)
- curl — curl (7.19.1)
- curl — curl (7.19.0)
- curl — curl (7.18.2)
- curl — curl (7.18.1)
- curl — curl (7.18.0)
- curl — curl (7.17.1)
- curl — curl (7.17.0)
- curl — curl (7.16.4)
- curl — curl (7.16.3)
- curl — curl (7.16.2)
- curl — curl (7.16.1)
- curl — curl (7.16.0)
- curl — curl (7.15.5)
- curl — curl (7.15.4)
- curl — curl (7.15.3)
- curl — curl (7.15.2)
- curl — curl (7.15.1)
- curl — curl (7.15.0)
- curl — curl (7.14.1)
- curl — curl (7.14.0)
- curl — curl (7.13.2)
- curl — curl (7.13.1)
- curl — curl (7.13.0)
- curl — curl (7.12.3)
- curl — curl (7.12.2)
- curl — curl (7.12.1)
- curl — curl (7.12.0)
- curl — curl (7.11.2)
- curl — curl (7.11.1)
- curl — curl (7.11.0)
- curl — curl (7.10.8)
- curl — curl (7.10.7)
- curl — curl (7.10.6)
- curl — curl (334d78cd18a7310144383929bdcef34ffbf6159b)

## References

- [CNA](https://curl.se/docs/CVE-2026-11856.json)
- [CNA](https://curl.se/docs/CVE-2026-11856.html)
- [CNA](https://hackerone.com/reports/3793260)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.69%
- **EPSS Percentile:** 51.0

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._