CVE-2026-86409
CVE-2026-86409 · stale SigV4 headers sent unintended
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Diese Seite zeigt ausgewählte Angaben aus den Quellen. Die vollständige Beschreibung und betroffene Versionen finden Sie in den verlinkten Sicherheitshinweisen.
Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information.
EPSS 0,3% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: system
Betroffene Produkte und Versionen
curl
- Softwareversionen
- ≥ 8.21.0, ≤ 8.21.0: Betroffen (semver)
- ≥ 8.20.0, ≤ 8.20.0: Betroffen (semver)
- ≥ 8.19.0, ≤ 8.19.0: Betroffen (semver)
- ≥ 8.18.0, ≤ 8.18.0: Betroffen (semver)
- ≥ 8.17.0, ≤ 8.17.0: Betroffen (semver)
- ≥ 8.16.0, ≤ 8.16.0: Betroffen (semver)
- ≥ 8.15.0, ≤ 8.15.0: Betroffen (semver)
- ≥ 8.14.1, ≤ 8.14.1: Betroffen (semver)
- ≥ 8.14.0, ≤ 8.14.0: Betroffen (semver)
- ≥ 8.13.0, ≤ 8.13.0: Betroffen (semver)
- ≥ 8.12.1, ≤ 8.12.1: Betroffen (semver)
- ≥ 8.12.0, ≤ 8.12.0: Betroffen (semver)
- ≥ 8.11.1, ≤ 8.11.1: Betroffen (semver)
- ≥ 8.11.0, ≤ 8.11.0: Betroffen (semver)
- ≥ 8.10.1, ≤ 8.10.1: Betroffen (semver)
- ≥ 8.10.0, ≤ 8.10.0: Betroffen (semver)
- ≥ 8.9.1, ≤ 8.9.1: Betroffen (semver)
- ≥ 8.9.0, ≤ 8.9.0: Betroffen (semver)
- ≥ 8.8.0, ≤ 8.8.0: Betroffen (semver)
- ≥ 8.7.1, ≤ 8.7.1: Betroffen (semver)
- ≥ 8.7.0, ≤ 8.7.0: Betroffen (semver)
- ≥ 8.6.0, ≤ 8.6.0: Betroffen (semver)
- ≥ 8.5.0, ≤ 8.5.0: Betroffen (semver)
- ≥ 8.4.0, ≤ 8.4.0: Betroffen (semver)
- ≥ 8.3.0, ≤ 8.3.0: Betroffen (semver)
- ≥ 8.2.1, ≤ 8.2.1: Betroffen (semver)
- ≥ 8.2.0, ≤ 8.2.0: Betroffen (semver)
- ≥ 8.1.2, ≤ 8.1.2: Betroffen (semver)
- ≥ 8.1.1, ≤ 8.1.1: Betroffen (semver)
- ≥ 8.1.0, ≤ 8.1.0: Betroffen (semver)
- ≥ 8.0.1, ≤ 8.0.1: Betroffen (semver)
- ≥ 8.0.0, ≤ 8.0.0: Betroffen (semver)
- ≥ 7.88.1, ≤ 7.88.1: Betroffen (semver)
- ≥ 7.88.0, ≤ 7.88.0: Betroffen (semver)
- ≥ 7.87.0, ≤ 7.87.0: Betroffen (semver)
- ≥ 7.86.0, ≤ 7.86.0: Betroffen (semver)
- ≥ 7.85.0, ≤ 7.85.0: Betroffen (semver)
- ≥ 7.84.0, ≤ 7.84.0: Betroffen (semver)
- ≥ 7.83.1, ≤ 7.83.1: Betroffen (semver)
- ≥ 7.83.0, ≤ 7.83.0: Betroffen (semver)
- ≥ 7.82.0, ≤ 7.82.0: Betroffen (semver)
- ≥ 7.81.0, ≤ 7.81.0: Betroffen (semver)
- ≥ 7.80.0, ≤ 7.80.0: Betroffen (semver)
- ≥ 7.79.1, ≤ 7.79.1: Betroffen (semver)
- ≥ 7.79.0, ≤ 7.79.0: Betroffen (semver)
Keine Korrektur veröffentlicht
curl Debian:12
- Softwareversionen
- 7.88.1-10
- 7.88.1-10+deb12u1
- 7.88.1-10+deb12u11
- 7.88.1-10+deb12u12
- 7.88.1-10+deb12u13
- 7.88.1-10+deb12u14
- 7.88.1-10+deb12u15
- 7.88.1-10+deb12u1~bpo11+1
- 7.88.1-10+deb12u2
- 7.88.1-10+deb12u3
- 7.88.1-10+deb12u3~bpo11+1
- 7.88.1-10+deb12u4
- 7.88.1-10+deb12u5
- 7.88.1-10+deb12u5~bpo11+1
- 7.88.1-10+deb12u6
- 7.88.1-10+deb12u6~bpo11+1
- 7.88.1-10+deb12u7
- 7.88.1-10+deb12u8
- 7.88.1-10+deb12u9
- 7.88.1-11
- 8.0.1-1~exp1
- 8.10.0-1
- 8.10.0-2
- 8.10.1-1
- 8.10.1-1~bpo12+1
- 8.10.1-2
- 8.11.0-1
- 8.11.1-1
- 8.11.1-1~bpo12+1
- 8.12.0+git20250209.89ed161+ds-1
- 8.12.0+git20250209.89ed161+ds-1~bpo12+1
- 8.12.1-1
- 8.12.1-2
- 8.12.1-2~bpo12+1
- 8.12.1-3
- 8.12.1-3~bpo12+1
- 8.13.0-1
- 8.13.0-1+exp1
- 8.13.0-2
- 8.13.0-2+exp1
- 8.13.0-3
- 8.13.0-4
- 8.13.0-4+exp1
- 8.13.0-5
- 8.13.0-5+exp1
- 8.13.0-5~bpo12+1
- 8.13.0~rc-1~exp1
- 8.13.0~rc-1~exp2
- 8.13.0~rc2-1
- 8.13.0~rc2-2
- 8.13.0~rc3-1
- 8.13.0~rc3-1+exp1
- 8.14.0-1
- 8.14.0-1+exp1
- 8.14.0~rc1-1+exp1
- 8.14.0~rc2-1+exp1
- 8.14.0~rc3-1+exp1
- 8.14.1-1
- 8.14.1-1~bpo12+1
- 8.14.1-2
- 8.14.1-2+exp1
- 8.14.1-2~bpo12+1
- 8.15.0-1
- 8.15.0-1~bpo13+1
- 8.15.0-1~exp1
- 8.15.0~rc1-1exp1
- 8.15.0~rc2-1~exp1
- 8.15.0~rc3-1~exp1
- 8.16.0-1
- 8.16.0-1+exp1
- 8.16.0-1~bpo13+1
- 8.16.0-2
- 8.16.0-3
- 8.16.0-4
- 8.16.0-4~bpo13+1
- 8.16.0~rc1-1~exp1
- 8.16.0~rc2-1
- 8.16.0~rc2-2
- 8.16.0~rc3-1
- 8.17.0-1
- 8.17.0-2
- 8.17.0-3
- 8.17.0~rc1-1~exp1
- 8.17.0~rc2-1
- 8.17.0~rc3-1
- 8.18.0-1
- 8.18.0-1~bpo13+1
- 8.18.0-2
- 8.18.0~rc1-1+exp1
- 8.18.0~rc2-1
- 8.18.0~rc3-1
- 8.19.0-1
- 8.19.0-1+exp1
- 8.19.0-1~bpo13+1
- 8.19.0-2
- 8.19.0-3
- 8.19.0-3+exp1
- 8.19.0-3+exp2
- 8.19.0~rc1-1~exp1
- 8.19.0~rc2-1
- 8.19.0~rc2-2
- 8.19.0~rc3-1
- 8.2.1-1
- 8.2.1-2
- 8.2.1-2~bpo12+1
- 8.20.0-1
- 8.20.0-1+exp
- 8.20.0-2
- 8.20.0-2+exp1
- 8.20.0-2~bpo13+1
- 8.20.0-3
- 8.20.0-4
- 8.20.0-5
- 8.20.0-5~bpo13+1
- 8.20.0~rc1-1+exp1
- 8.20.0~rc1-1+exp2
- 8.20.0~rc1-1+exp3
- 8.20.0~rc2-1
- 8.20.0~rc2-1+exp1
- 8.20.0~rc3-1
- 8.20.0~rc3-1+exp1
- 8.21.0-1
- 8.21.0-1+exp1
- 8.21.0-2
- 8.21.0-2+exp1
- 8.21.0-2~bpo13+1
- 8.21.0~rc1-1+exp1
- 8.21.0~rc2-1
- 8.21.0~rc2-1+exp1
- 8.21.0~rc3-1
- 8.21.0~rc3-1+exp1
- 8.22.0-1
- 8.22.0-1+exp1
- 8.22.0~rc2-1
- 8.22.0~rc2-2
- 8.22.0~rc3-1
- 8.22.0~rc3-1+exp1
- 8.23.0-1
- 8.23.0~rc1-1
- 8.23.0~rc1-2
- 8.23.0~rc2-1
- 8.23.0~rc2-1+exp1
- 8.23.0~rc3-1
- 8.23.0~rc3-1+exp1
- 8.3.0-1
- 8.3.0-2
- 8.3.0-2~bpo12+1
- 8.3.0-2~exp1
- 8.3.0-3
- 8.4.0-1
- 8.4.0-2
- 8.4.0-2~bpo12+1
- 8.5.0-1
- 8.5.0-1+exp1
- 8.5.0-2
- 8.5.0-2+exp1
- 8.5.0-2~bpo12+1
- 8.6.0-1
- 8.6.0-1.1
- 8.6.0-2
- 8.6.0-3
- 8.6.0-3.1
- 8.6.0-3.1~exp1
- 8.6.0-3.1~exp2
- 8.6.0-3.2
- 8.6.0-4
- 8.7.1-1
- 8.7.1-1+exp1
- 8.7.1-2
- 8.7.1-3
- 8.7.1-4
- 8.7.1-5
- 8.7.1-5+exp1
- 8.7.1-5~bpo12+1
- 8.8.0-1
- 8.8.0-1+exp1
- 8.8.0-1+exp2
- 8.8.0-1~bpo12+1
- 8.8.0-2
- 8.8.0-3
- 8.8.0-4
- 8.9.0-1
- 8.9.0-2
- 8.9.0-3
- 8.9.1-1
- 8.9.1-2
- 8.9.1-2~bpo12+1
- Betroffene Versionsbereiche
- ECOSYSTEM: (−∞, +∞)
Keine Korrektur veröffentlicht
curl Debian:13
- Softwareversionen
- 8.14.1-2
- 8.14.1-2+deb13u1
- 8.14.1-2+deb13u2
- 8.14.1-2+deb13u2~bpo13+1
- 8.14.1-2+deb13u3
- 8.14.1-2+deb13u4
- 8.14.1-2+deb13u5
- 8.14.1-2+deb13u7
- 8.14.1-2+exp1
- 8.15.0-1
- 8.15.0-1~bpo13+1
- 8.15.0-1~exp1
- 8.15.0~rc1-1exp1
- 8.15.0~rc2-1~exp1
- 8.15.0~rc3-1~exp1
- 8.16.0-1
- 8.16.0-1+exp1
- 8.16.0-1~bpo13+1
- 8.16.0-2
- 8.16.0-3
- 8.16.0-4
- 8.16.0-4~bpo13+1
- 8.16.0~rc1-1~exp1
- 8.16.0~rc2-1
- 8.16.0~rc2-2
- 8.16.0~rc3-1
- 8.17.0-1
- 8.17.0-2
- 8.17.0-3
- 8.17.0~rc1-1~exp1
- 8.17.0~rc2-1
- 8.17.0~rc3-1
- 8.18.0-1
- 8.18.0-1~bpo13+1
- 8.18.0-2
- 8.18.0~rc1-1+exp1
- 8.18.0~rc2-1
- 8.18.0~rc3-1
- 8.19.0-1
- 8.19.0-1+exp1
- 8.19.0-1~bpo13+1
- 8.19.0-2
- 8.19.0-3
- 8.19.0-3+exp1
- 8.19.0-3+exp2
- 8.19.0~rc1-1~exp1
- 8.19.0~rc2-1
- 8.19.0~rc2-2
- 8.19.0~rc3-1
- 8.20.0-1
- 8.20.0-1+exp
- 8.20.0-2
- 8.20.0-2+exp1
- 8.20.0-2~bpo13+1
- 8.20.0-3
- 8.20.0-4
- 8.20.0-5
- 8.20.0-5~bpo13+1
- 8.20.0~rc1-1+exp1
- 8.20.0~rc1-1+exp2
- 8.20.0~rc1-1+exp3
- 8.20.0~rc2-1
- 8.20.0~rc2-1+exp1
- 8.20.0~rc3-1
- 8.20.0~rc3-1+exp1
- 8.21.0-1
- 8.21.0-1+exp1
- 8.21.0-2
- 8.21.0-2+exp1
- 8.21.0-2~bpo13+1
- 8.21.0~rc1-1+exp1
- 8.21.0~rc2-1
- 8.21.0~rc2-1+exp1
- 8.21.0~rc3-1
- 8.21.0~rc3-1+exp1
- 8.22.0-1
- 8.22.0-1+exp1
- 8.22.0~rc2-1
- 8.22.0~rc2-2
- 8.22.0~rc3-1
- 8.22.0~rc3-1+exp1
- 8.23.0-1
- 8.23.0~rc1-1
- 8.23.0~rc1-2
- 8.23.0~rc2-1
- 8.23.0~rc2-1+exp1
- 8.23.0~rc3-1
- 8.23.0~rc3-1+exp1
- Betroffene Versionsbereiche
- ECOSYSTEM: (−∞, +∞)
Keine Korrektur veröffentlicht
curl Debian:14
- Softwareversionen
- 8.14.1-2
- 8.14.1-2+exp1
- 8.15.0-1
- 8.15.0-1~bpo13+1
- 8.15.0-1~exp1
- 8.15.0~rc1-1exp1
- 8.15.0~rc2-1~exp1
- 8.15.0~rc3-1~exp1
- 8.16.0-1
- 8.16.0-1+exp1
- 8.16.0-1~bpo13+1
- 8.16.0-2
- 8.16.0-3
- 8.16.0-4
- 8.16.0-4~bpo13+1
- 8.16.0~rc1-1~exp1
- 8.16.0~rc2-1
- 8.16.0~rc2-2
- 8.16.0~rc3-1
- 8.17.0-1
- 8.17.0-2
- 8.17.0-3
- 8.17.0~rc1-1~exp1
- 8.17.0~rc2-1
- 8.17.0~rc3-1
- 8.18.0-1
- 8.18.0-1~bpo13+1
- 8.18.0-2
- 8.18.0~rc1-1+exp1
- 8.18.0~rc2-1
- 8.18.0~rc3-1
- 8.19.0-1
- 8.19.0-1+exp1
- 8.19.0-1~bpo13+1
- 8.19.0-2
- 8.19.0-3
- 8.19.0-3+exp1
- 8.19.0-3+exp2
- 8.19.0~rc1-1~exp1
- 8.19.0~rc2-1
- 8.19.0~rc2-2
- 8.19.0~rc3-1
- 8.20.0-1
- 8.20.0-1+exp
- 8.20.0-2
- 8.20.0-2+exp1
- 8.20.0-2~bpo13+1
- 8.20.0-3
- 8.20.0-4
- 8.20.0-5
- 8.20.0-5~bpo13+1
- 8.20.0~rc1-1+exp1
- 8.20.0~rc1-1+exp2
- 8.20.0~rc1-1+exp3
- 8.20.0~rc2-1
- 8.20.0~rc2-1+exp1
- 8.20.0~rc3-1
- 8.20.0~rc3-1+exp1
- 8.21.0-1
- 8.21.0-1+exp1
- 8.21.0-2
- 8.21.0-2+exp1
- 8.21.0-2~bpo13+1
- 8.21.0~rc1-1+exp1
- 8.21.0~rc2-1
- 8.21.0~rc2-1+exp1
- 8.21.0~rc3-1
- 8.21.0~rc3-1+exp1
- 8.22.0~rc2-1
- 8.22.0~rc2-2
- 8.22.0~rc3-1
- 8.22.0~rc3-1+exp1
- Betroffene Versionsbereiche
- ECOSYSTEM: < 8.22.0-1
Auf 8.22.0-1 aktualisieren
curl Ubuntu:22.04:LTS
- Softwareversionen
- 7.74.0-1.3ubuntu2
- 7.74.0-1.3ubuntu3
- 7.80.0-3
- 7.81.0-1
- 7.81.0-1ubuntu1.1
- 7.81.0-1ubuntu1.2
- 7.81.0-1ubuntu1.3
- 7.81.0-1ubuntu1.4
- 7.81.0-1ubuntu1.6
- 7.81.0-1ubuntu1.7
- 7.81.0-1ubuntu1.8
- 7.81.0-1ubuntu1.10
- 7.81.0-1ubuntu1.11
- 7.81.0-1ubuntu1.13
- 7.81.0-1ubuntu1.14
- 7.81.0-1ubuntu1.15
- 7.81.0-1ubuntu1.16
- 7.81.0-1ubuntu1.17
- 7.81.0-1ubuntu1.18
- 7.81.0-1ubuntu1.19
- 7.81.0-1ubuntu1.20
- 7.81.0-1ubuntu1.21
- 7.81.0-1ubuntu1.22
- 7.81.0-1ubuntu1.23
- 7.81.0-1ubuntu1.24
- 7.81.0-1ubuntu1.25
- 7.81.0-1ubuntu1.26
- 7.81.0-1ubuntu1.27
- 7.81.0-1ubuntu1.29
- Betroffene Versionsbereiche
- ECOSYSTEM: < 7.81.0-1ubuntu1.30
Auf 7.81.0-1ubuntu1.30 aktualisieren
curl Ubuntu:24.04:LTS
- Softwareversionen
- 8.2.1-1ubuntu3
- 8.2.1-1ubuntu3.1
- 8.4.0-2ubuntu1
- 8.5.0-2ubuntu1
- 8.5.0-2ubuntu2
- 8.5.0-2ubuntu8
- 8.5.0-2ubuntu9
- 8.5.0-2ubuntu10
- 8.5.0-2ubuntu10.1
- 8.5.0-2ubuntu10.2
- 8.5.0-2ubuntu10.3
- 8.5.0-2ubuntu10.4
- 8.5.0-2ubuntu10.5
- 8.5.0-2ubuntu10.6
- 8.5.0-2ubuntu10.7
- 8.5.0-2ubuntu10.8
- 8.5.0-2ubuntu10.9
- 8.5.0-2ubuntu10.10
- 8.5.0-2ubuntu10.11
- 8.5.0-2ubuntu10.12
- 8.5.0-2ubuntu10.13
- 8.5.0-2ubuntu10.15
- Betroffene Versionsbereiche
- ECOSYSTEM: < 8.5.0-2ubuntu10.16
Auf 8.5.0-2ubuntu10.16 aktualisieren
curl Ubuntu:26.10
- Softwareversionen
- 8.18.0-1ubuntu2
- 8.20.0-2ubuntu1
- 8.20.0-2ubuntu3
- 8.20.0-2ubuntu10
- 8.20.0-2ubuntu11
- Betroffene Versionsbereiche
- ECOSYSTEM: < 8.20.0-2ubuntu11.1
Auf 8.20.0-2ubuntu11.1 aktualisieren
curl Ubuntu:26.04:LTS
- Softwareversionen
- 8.14.1-2ubuntu1
- 8.17.0-1ubuntu1
- 8.18.0-1ubuntu1
- 8.18.0-1ubuntu2
- 8.18.0-1ubuntu2.1
- 8.18.0-1ubuntu2.2
- 8.18.0-1ubuntu2.3
- 8.18.0-1ubuntu2.4
- 8.18.0-1ubuntu2.5
- 8.18.0-1ubuntu2.7
- Betroffene Versionsbereiche
- ECOSYSTEM: < 8.18.0-1ubuntu2.8
Auf 8.18.0-1ubuntu2.8 aktualisieren