CVE-2026-9546: Haxx Curl Information Disclosure Flaw

CVE-2026-9546 Overview

CVE-2026-9546 is an information disclosure vulnerability in libcurl that causes the HTTP Referer: header to persist across requests even after being explicitly cleared. The documentation states that passing NULL to CURLOPT_REFERER suppresses the header, but the option fails to clear the internal state. As a result, the previously configured referrer string is reused and sent in subsequent requests. Applications that reuse a curl handle across multiple destinations may leak sensitive referrer information to unintended servers. The flaw affects the widely deployed haxx curl library, which is embedded in countless applications, appliances, and language runtimes.

Critical Impact
Sensitive referrer strings, which can contain URLs with authentication tokens, session identifiers, or internal paths, may leak to third-party servers through reused libcurl handles.

Affected Products

Haxx curl (libcurl) — versions where CURLOPT_REFERER fails to clear internal referrer state
Applications and services that reuse curl handles across multiple HTTP requests
Language bindings and wrappers relying on libcurl for HTTP transport

Discovery Timeline

2026-07-03 - CVE-2026-9546 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-9546

Vulnerability Analysis

The vulnerability resides in libcurl's handling of the CURLOPT_REFERER option. According to the documented API contract, calling curl_easy_setopt(handle, CURLOPT_REFERER, NULL) should remove any previously set referrer and suppress the Referer: header in outgoing HTTP requests. In the vulnerable code path, the NULL assignment does not reset the internal referrer state pointer. Consequently, the previously stored referrer string remains bound to the easy handle and is serialized into subsequent request headers.

Applications that reuse curl handles for performance benefit from connection keep-alive and TLS session reuse. This reuse pattern is precisely what makes the flaw exploitable in practice. A developer following the documented approach to clear the referrer will still transmit stale data on the wire.

Root Cause

The root cause is missing state cleanup in the option-setter branch that handles a NULL argument for CURLOPT_REFERER. Instead of freeing or unsetting the stored referrer string and clearing the associated header-emission flag, the code returns success while leaving the previous value intact. This constitutes an information exposure ([CWE-noinfo] as classified in NVD) rooted in an incomplete input-validation and state-reset routine.

Attack Vector

The vulnerability is network-adjacent from the perspective of the receiving server, but requires no authentication or user interaction on the client side. An attacker does not directly trigger the bug. Instead, an attacker controls a server that receives requests from a vulnerable client. When the client reuses a curl handle after previously setting a sensitive referrer, the stale header discloses that value to the attacker-controlled endpoint.

Typical leakage scenarios include referrers containing OAuth redirect URLs with authorization codes, internal intranet URLs, one-time password reset links, or query strings carrying session tokens. Any application that navigates from a trusted origin to an untrusted origin using the same curl handle is exposed.

Refer to the cURL CVE-2026-9546 Documentation and HackerOne Report #3754343 for the upstream technical description.

Detection Methods for CVE-2026-9546

Indicators of Compromise

Outbound HTTP requests containing Referer: headers pointing to internal, sensitive, or previously visited resources when the application logic expected no referrer.
Access logs on third-party endpoints receiving Referer values referencing unrelated internal hostnames or tokenized URLs.
Applications built against vulnerable versions of libcurl that reuse handles across differing destinations.

Detection Strategies

Inventory all binaries, containers, and language runtimes that link against libcurl and compare linked versions against the fixed release listed in the vendor advisory.
Instrument HTTP client wrappers to log outgoing Referer header values in test environments and assert that clearing the referrer produces requests without the header.
Perform egress traffic inspection on proxies to flag Referer values that contain authentication tokens, session IDs, or internal-only hostnames leaving the environment.

Monitoring Recommendations

Monitor package inventories for libcurl and curl versions across Linux distributions, container images, and third-party appliances.
Enable HTTP request auditing at outbound proxies and alert on Referer headers destined for untrusted external domains.
Track application dependency manifests (for example, requirements.txt, go.sum, Cargo.lock) for pinned curl bindings that predate the fixed release.

How to Mitigate CVE-2026-9546

Immediate Actions Required

Upgrade libcurl to the fixed version identified in the cURL CVE-2026-9546 Documentation.
Rebuild and redeploy applications that statically link libcurl after applying the patched library.
Audit application code paths that call curl_easy_setopt with CURLOPT_REFERER and confirm expected behavior against the patched library.

Patch Information

The curl project has published an advisory and patched release documented at cURL CVE-2026-9546 Documentation. Machine-readable metadata is available in the cURL CVE-2026-9546 JSON Format. Downstream Linux distributions typically ship backported fixes through their standard security update channels; apply vendor updates through apt, dnf, yum, or the equivalent package manager.

Workarounds

Call curl_easy_reset on the handle between requests to different destinations instead of relying on CURLOPT_REFERER set to NULL.
Set CURLOPT_REFERER to an empty string explicitly before each request that must not carry a referrer, and verify header emission in test coverage.
Allocate a fresh curl easy handle for each request to sensitive or untrusted destinations, accepting the performance trade-off until the patched library is deployed.