CVE-2026-11856: cross-origin Digest auth state leak
Modified
AliasesALPINE-CVE-2026-11856UBUNTU-CVE-2026-11856DEBIAN-CVE-2026-11856CGA-x635-4h7x-365gCGA-283w-2j5q-8mc9CGA-4hvp-ggcf-v62vCGA-6hmx-9x2r-c7qwCGA-6q8p-5phh-gp9pCGA-85f5-9hgx-9qvrCGA-c5p2-6fjw-m9hcCGA-cjh2-7rjc-f3hxCGA-cpv8-328h-jmqfCGA-ggmh-36wf-wxh8CGA-h322-v395-hq4hCGA-hw2c-8257-9jwjCGA-j455-fpqm-53hgCGA-mg5c-8xgv-3pg3CGA-mgjq-524h-jj64CGA-pghg-fpqq-g26mCGA-r9jj-cmqj-9vr2CGA-w3v5-wqmw-6jfxCGA-ww9q-fqm2-9hv2CGA-x2mw-ph27-fppgCGA-xvf6-74x6-vgcw
Published 03-07-2026Last modified 15-09-2026
Vulnerability summary
CVE-2026-11856 is a critical (CVSS 9.8) Authentication Bypass by Capture-replay vulnerability in curl. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52.7% of scored vulnerabilities. 1 public exploit is recorded.
Priority
Prioritisepublic exploit
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
0.69%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 7 · Related 4Timeline
- 03-07-2026PublishedVulnerability first disclosed.
- 15-09-2026Last modifiedVulnerability information updated.
Description
Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.
CVSS metrics
7 scores · 7 sources · 1 versionCritical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 7 agree
- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.69%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.69% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard11 products
- eco-python-curl< 8.21.0-r0
- eco-python-curl-minimal< 8.21.0-r0
- eco-python-curl-minimal-bin< 8.21.0-r0
- eco-python-curl-minimal-dev< 8.21.0-r0
- eco-python-curl-minimal-doc< 8.21.0-r0
Alpine1 product
- curl≥ 7.10.6, < 8.22.0-r0 | ≥ 7.10.6, < 8.21.0-r0
Curl1 product
- curl≥ 7.10.6, < 8.14.2 | ≥ 8.15.0, < 8.16.1 | ≥ 8.17.0, < 8.20.1 | ≥ 334d78cd18a7310144383929bdcef34ffbf6159b, < 5c6b4880357ab3e72967c1c45cae0f96ffabc535 | 8.20.0 | 8.19.0 | 8.18.0 | 8.17.0 | 8.16.0 | 8.15.0 | 8.14.1 | 8.14.0 | 8.13.0 | 8.12.1 | 8.12.0 | 8.11.1 | 8.11.0 | 8.10.1 | 8.10.0 | 8.9.1 | 8.9.0 | 8.8.0 | 8.7.1 | 8.7.0 | 8.6.0 | 8.5.0 | 8.4.0 | 8.3.0 | 8.2.1 | 8.2.0 | 8.1.2 | 8.1.1 | 8.1.0 | 8.0.1 | 8.0.0 | 7.88.1 | 7.88.0 | 7.87.0 | 7.86.0 | 7.85.0 | 7.84.0 | 7.83.1 | 7.83.0 | 7.82.0 | 7.81.0 | 7.80.0 | 7.79.1 | 7.79.0 | 7.78.0 | 7.77.0 | 7.76.1 | 7.76.0 | 7.75.0 | 7.74.0 | 7.73.0 | 7.72.0 | 7.71.1 | 7.71.0 | 7.70.0 | 7.69.1 | 7.69.0 | 7.68.0 | 7.67.0 | 7.66.0 | 7.65.3 | 7.65.2 | 7.65.1 | 7.65.0 | 7.64.1 | 7.64.0 | 7.63.0 | 7.62.0 | 7.61.1 | 7.61.0 | 7.60.0 | 7.59.0 | 7.58.0 | 7.57.0 | 7.56.1 | 7.56.0 | 7.55.1 | 7.55.0 | 7.54.1 | 7.54.0 | 7.53.1 | 7.53.0 | 7.52.1 | 7.52.0 | 7.51.0 | 7.50.3 | 7.50.2 | 7.50.1 | 7.50.0 | 7.49.1 | 7.49.0 | 7.48.0 | 7.47.1 | 7.47.0 | 7.46.0 | 7.45.0 | 7.44.0 | 7.43.0 | 7.42.1 | 7.42.0 | 7.41.0 | 7.40.0 | 7.39.0 | 7.38.0 | 7.37.1 | 7.37.0 | 7.36.0 | 7.35.0 | 7.34.0 | 7.33.0 | 7.32.0 | 7.31.0 | 7.30.0 | 7.29.0 | 7.28.1 | 7.28.0 | 7.27.0 | 7.26.0 | 7.25.0 | 7.24.0 | 7.23.1 | 7.23.0 | 7.22.0 | 7.21.7 | 7.21.6 | 7.21.5 | 7.21.4 | 7.21.3 | 7.21.2 | 7.21.1 | 7.21.0 | 7.20.1 | 7.20.0 | 7.19.7 | 7.19.6 | 7.19.5 | 7.19.4 | 7.19.3 | 7.19.2 | 7.19.1 | 7.19.0 | 7.18.2 | 7.18.1 | 7.18.0 | 7.17.1 | 7.17.0 | 7.16.4 | 7.16.3 | 7.16.2 | 7.16.1 | 7.16.0 | 7.15.5 | 7.15.4 | 7.15.3 | 7.15.2 | 7.15.1 | 7.15.0 | 7.14.1 | 7.14.0 | 7.13.2 | 7.13.1 | 7.13.0 | 7.12.3 | 7.12.2 | 7.12.1 | 7.12.0 | 7.11.2 | 7.11.1 | 7.11.0 | 7.10.8 | 7.10.7 | 7.10.6
Debian1 product
- curlAll versions (No fix recorded) | < 8.21.0~rc3-1
Haxx1 product
- curl≥ 7.10.6, < 8.21.0
Ubuntu1 product
- curl< 7.35.0-1ubuntu2.20+esm22 | < 7.47.0-1ubuntu2.19+esm18 | < 7.58.0-2ubuntu3.24+esm11 | < 7.68.0-1ubuntu2.25+esm6 | < 7.81.0-1ubuntu1.26 | < 8.5.0-2ubuntu10.12 | All versions (No fix recorded) | < 8.18.0-1ubuntu2.4
Wolfi1 product
- libcurl4All versions (No fix recorded)
7 vendors · 17 products
