Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-08 | 1 | Patch1 |
| 2026-08-01 | 1 | Disclosure1 |
🔐 curl CVE-2026-11856: critical Digest auth state leak. Credentials from one HTTP origin silently reused against a different host on the next transfer. CVSS 9.8, patch available now. https://secalerts.co/vulnerability/CVE-2026-11856?utm_campaign=x https://t.co/xxdMNeBQAq
Post summary
The post discloses a critical Digest authentication state leak (CVE‑2026‑11856) and informs readers that a vendor patch is now available.
#IBMAIX ■ Security Bulletin: Multiple vulnerabilities impact AIX due to CURL libcurl (CVE-2026-10536, CVE-2026-11856, CVE-2026-8286, CVE-2026-8458, CVE-2026-8924, CVE-2026-8927, CVE-2026-8932, CVE-2026-9547). https://www.ibm.com/support/pages/node/7281743 沢山あります！ 😱
Post summary
IBM released a security bulletin announcing eight AIX vulnerabilities linked to libcurl and provided a link to a vendor advisory.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | haxx | curl | - | - | - |