CVE-2026-9546: sending old referer
A vulnerability in libcurl caused the HTTP Referer: header to persist even when explicitly cleared. While the documentation states that passing NULL to CURLOPTREFERER suppresses the header, the option failed to clear the internal state. As a result the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9546?
CVE-2026-9546 has a high severity rating of 7.5 according to CVSS 3.1.
What is CVE-2026-9546 about?
CVE-2026-9546 refers to a vulnerability in libcurl that allows the HTTP 'Referer:' header to persist even when explicitly cleared.
How do I fix CVE-2026-9546?
To fix CVE-2026-9546, users should apply the available patch for libcurl.
What type of vulnerability is CVE-2026-9546 classified as?
CVE-2026-9546 is classified as an information leak vulnerability.
What software is affected by CVE-2026-9546?
The affected software for CVE-2026-9546 includes libcurl and haxx curl.