CVE-2026-11856

ADVISORY - nist

Summary

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.

EPSS Score⁠: 0.00604 (0.463)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-294⁠

Authentication Bypass by Capture-replay

Impacted images

Advisories

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.