CVE-2026-9546

Name of the Vulnerable Software and Affected Versions libcurl (affected versions not specified)

Description An issue exists where the HTTP Referer: header persists even after being explicitly cleared. Although passing NULL to CURLOPT REFERER is intended to suppress the header, the internal state is not cleared. This causes the previous referrer string to be reused and sent in subsequent requests, which may lead to the leakage of sensitive information to unintended servers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.