CVE-2026-86409
ADVISORY - nistSummary
Setting CURLOPT_AWS_SIGV4 to NULL but does not disable SigV4 authentication,
contrary to expectations and documentation. A subsequent transfer on the same
handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL
isset next, leaking state information.
EPSS Score: 0.01096 (0.656)
Common Weakness Enumeration (CWE)
ADVISORY - nist
Insertion of Sensitive Information Into Sent Data
NIST
CREATED
UPDATED
ADVISORY IDCVE-2026-86409
EXPLOITABILITY SCORE
2.2
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
8.1highAlpine
CREATED
UPDATED
ADVISORY IDCVE-2026-86409
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Debian
CREATED
UPDATED
ADVISORY IDCVE-2026-86409
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Ubuntu
CREATED
UPDATED
ADVISORY IDCVE-2026-86409
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/Alowminimos
CREATED
UPDATED
ADVISORY ID
MINI-7c46-pm2w-833c
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
minimos
CREATED
UPDATED
ADVISORY ID
MINI-hhjx-8w93-wcqx
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-