CVE-2026-86409

Not scored yetLast modified Oct 22, 2026

Description

Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 20, 2026
Last modified
Oct 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-86410A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, anCVE-2026-86411An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `CVE-2026-86412A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using CVE-2026-86413When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credenCVE-2026-86414An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, CVE-2026-86415libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated SchannCVE-2026-864165.4ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() andCVE-2026-864174.3Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetcCVE-2026-864184.3Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restriCVE-2026-864199.1Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery fuCVE-2026-864207.5ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated CVE-2026-864217.5ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation wi
CVE-2026-86409: Unscored | Vulnix