CVE-2026-9546 sending old referer

What is CVE-2026-9546?

CVE-2026-9546 is a high-severity vulnerability in Haxx Curl, published on 3 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.

Weakness: CWE-200

Which versions are affected by CVE-2026-9546?

It affects 1 product.

Products include Haxx Curl.

How do I fix CVE-2026-9546?

Apply the vendor's patch.

Is CVE-2026-9546 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-9546 exists.

Other vulnerabilities in Haxx Curl

• CVE-2026-19931 Negotiate ambient user conn reuse Critical 9.8
• CVE-2026-10536 HTTP/2 stream-dependency tree UAF Critical 9.8
• CVE-2026-11856 cross-origin Digest auth state leak Critical 9.8
• CVE-2026-8925 SASL double-free Critical 9.8
• CVE-2026-9079 stale proxy password leak Critical 9.8

All Haxx Curl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-9546, BELL-CVE-2026-9546, CURL-CVE-2026-9546, DEBIAN-CVE-2026-9546, GHSA-25rx-86v8-32c6, JLSEC-2026-1221 and 2 more.