The vulnerability in libcurl involves improper handling of the Authorization header when reusing the same handle for HTTP transfers with Digest authentication. After successfully authenticating to a specific HTTP origin (hostA), if the origin is changed to another host (hostB) for a subsequent transfer, libcurl erroneously forwards the Authorization header meant for hostA to hostB. This could lead to unintended credential disclosure to the second origin.

The impact is the potential leakage of Authorization header credentials to an unintended HTTP origin when reusing the same libcurl handle with Digest authentication. This could expose sensitive authentication information to a different server than originally intended, potentially compromising security depending on the trustworthiness of the second origin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid reusing the same libcurl handle for transfers to different HTTP origins when using Digest authentication to prevent accidental credential leakage.