CVE-2026-9546: libcurl HTTP Referer Header Leak Vulnerability

Technical summary

The vulnerability exists in libcurl's HTTP header handling logic. The CURLOPT_REFERER option is documented to suppress the Referer header when set to NULL, but the implementation does not properly clear the internal state variable storing the referrer. On the next HTTP request, the library sends the previously-set Referer value instead of omitting the header. This occurs because the state is not reset to a null or empty condition; rather, a stale pointer or string reference persists across request boundaries. An attacker or a malicious redirect chain can cause a legitimate client application to send a sensitive referrer (potentially containing authentication tokens or internal URLs) to an attacker-controlled server, violating the application's intended security posture.

Business impact

Organizations relying on libcurl to build privacy-aware or security-sensitive applications face data leakage risk. Applications that intentionally clear the Referer header to protect user privacy (e.g., anonymized browsing, API clients that handle sensitive URLs) may inadvertently expose sensitive referrer data to third parties. For API clients, this could leak internal service URLs or token-bearing URLs. For browser-like applications, it could expose user browsing history or session identifiers. The impact is particularly acute in regulated environments (financial services, healthcare, government) where unintended data disclosure can trigger compliance violations and reputational harm.

Affected systems

The vulnerability affects libcurl in haxx curl. The exact version range is not specified in the available data; verify against the vendor advisory for which versions are affected and the patched versions available. Any application statically or dynamically linking libcurl and relying on NULL-passing to suppress the Referer header is vulnerable.

Exploitability

The vulnerability requires no special network position or user interaction. An attacker can exploit this by hosting a server and causing a vulnerable libcurl application to make an HTTP request that includes a previously-set Referer header. This can occur through a malicious redirect chain, a crafted HTML response with embedded resource requests, or direct manipulation of application behavior if the attacker controls request targets. The CVSS 3.1 score of 7.5 (HIGH, with high confidentiality impact, no integrity or availability impact) reflects the ease of triggering information disclosure: network-accessible, low complexity, no privileges required, no user interaction needed.

Remediation

Apply the patched version of libcurl released by haxx curl. Verify against the vendor advisory for the specific patched version and supported upgrade path for your deployment. Organizations using libcurl should prioritize patching because the fix is straightforward and the exposure is passive (no code changes required in dependent applications). For immediate containment, review applications that intentionally clear headers and consider restricting outbound HTTP destinations to trusted domains or implementing header filtering at the application level.

Patch guidance

Consult the haxx curl security advisory and release notes to identify the patched version. Update libcurl across all systems where it is installed, including development environments, CI/CD pipelines, and production systems. If you build libcurl from source, pull the latest code from the main branch or cherry-pick the fix commit. If you use a package manager (apt, yum, brew, etc.), check for available updates and apply them. Verify the patch by reviewing libcurl's changelog or consulting the vendor advisory for the specific CVE-2026-9546 fix.

Detection guidance

Monitor libcurl version inventory across your infrastructure using software asset management tools or dependency scanning. Check application logs for unexpected Referer headers in outbound HTTP requests, particularly those sent to external or untrusted domains. If you control the source code of applications using libcurl, review instances of CURLOPT_REFERER being set to NULL and inspect whether sensitive referrer data could leak from previous requests. Network monitoring (packet inspection or HTTP proxy logs) can reveal unintended Referer headers in traffic. Consider adding telemetry to detect when Referer headers are sent in contexts where they should be absent.

Why prioritize this

This vulnerability scores HIGH (7.5) due to high confidentiality impact and minimal barriers to exploitation. It is not currently listed in the CISA KEV catalog, which may reflect the relative newness or low observed active exploitation. However, organizations handling sensitive data should prioritize patching because the flaw is passive (requires no user interaction or special network position), the attack surface is broad (any application using libcurl), and the potential data leakage can violate privacy commitments and compliance obligations. The fix is routine software patching with no expected breaking changes.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: (1) Network-accessible attack vector with no special position required, (2) Low attack complexity—straightforward exploitation via HTTP requests, (3) No authentication or privileges required, (4) No user interaction required, (5) High confidentiality impact from unintended data disclosure, and (6) No impact on integrity or availability. The score is HIGH rather than CRITICAL because the exposure is passive (information disclosure only) and does not enable system compromise or denial of service.

Frequently asked questions