GHSA-25rx-86v8-32c6
A vulnerability in libcurl causes the HTTP Referer header to persist even when explicitly cleared by passing NULL to CURLOPT_REFERER. This results in the previous referrer string being reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.
AI Analysis
Technical Summary
The libcurl library contains a vulnerability where the HTTP Referer header is not properly cleared when the CURLOPT_REFERER option is set to NULL. Instead of suppressing the header as documented, the internal state retains the previous referrer value, causing it to be sent in later HTTP requests. This behavior can lead to unintended disclosure of sensitive referrer information to servers that should not receive it.
Potential Impact
Sensitive information contained in the HTTP Referer header may be leaked to unintended servers due to the persistence of the header value across requests. This could expose confidential URLs or data embedded in the referrer string, potentially compromising user privacy or security.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when relying on CURLOPT_REFERER to suppress the Referer header and consider alternative methods to control header transmission.
GHSA-25rx-86v8-32c6
Description
A vulnerability in libcurl causes the HTTP Referer header to persist even when explicitly cleared by passing NULL to CURLOPT_REFERER. This results in the previous referrer string being reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The libcurl library contains a vulnerability where the HTTP Referer header is not properly cleared when the CURLOPT_REFERER option is set to NULL. Instead of suppressing the header as documented, the internal state retains the previous referrer value, causing it to be sent in later HTTP requests. This behavior can lead to unintended disclosure of sensitive referrer information to servers that should not receive it.
Potential Impact
Sensitive information contained in the HTTP Referer header may be leaked to unintended servers due to the persistence of the header value across requests. This could expose confidential URLs or data embedded in the referrer string, potentially compromising user privacy or security.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when relying on CURLOPT_REFERER to suppress the Referer header and consider alternative methods to control header transmission.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-25rx-86v8-32c6
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-9546"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a483cb527e9c79719d820c3
Added to database: 07/03/2026, 22:50:29 UTC
Last enriched: 07/03/2026, 23:03:03 UTC
Last updated: 07/04/2026, 00:11:21 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.