CVE-2026-9546: curl — Exploit & Fix

Description

A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.

Is your site exposed to CVE-2026-9546?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploit Prediction

0.0065

Probability of exploitation

0.47%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Affected Products

Vendor	Product	Versions
haxx	curl	8.18.0 — 8.21.0

References

Advisories & Patches

https://curl.se/docs/CVE-2026-9546.html

Exploits

https://hackerone.com/reports/3754343 https://hackerone.com/reports/3754343

Other References

https://curl.se/docs/CVE-2026-9546.json

Frequently Asked Questions

What is CVE-2026-9546? +

A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2026-9546? +

CVE-2026-9546 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0065, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-9546? +

CVE-2026-9546 affects products from haxx, specifically: curl. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-9546? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-11856 9.8

Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the …

CVE-2026-9079 9.8

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the …

CVE-2026-10536 9.8

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes …

CVE-2026-8925 9.8

The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the …

CVE-2026-8924 9.1

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public …

CVE-2026-8927 9.1

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication …

CVE-2026-9546