Setting CURLOPT_AWS_SIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. (CVE-2026-86409)

This vulnerability involves improper handling of the CURLOPT_AWS_SIGV4 option in a software component that uses AWS SigV4 authentication. When this option is set to NULL, the software does not disable SigV4 authentication as documented. As a result, subsequent HTTP transfers using the same handle still include the Authorization header with AWS4-HMAC-SHA256 signatures, which may leak sensitive authentication state information to URLs that should not receive it.

The impact is the unintended leakage of AWS SigV4 authentication headers to URLs beyond the intended scope. This could expose sensitive authentication information, potentially allowing unauthorized parties to gain insight into authentication credentials or session state. However, no active exploits in the wild are known at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid reusing handles with CURLOPT_AWS_SIGV4 set to NULL for multiple transfers or explicitly manage authentication headers to prevent leakage.