AZL-91803

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91803.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-91803
Upstream
Published
2026-07-03T07:16:23Z
Modified
2026-08-29T05:27:27Z
Summary
CVE-2026-11856 affecting package curl for versions less than 8.11.1-11
Details

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.

References

Affected packages

Azure Linux:3 / curl

Package

Name
curl
Purl
pkg:rpm/azure-linux/curl

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.11.1-11

Database specific

source 
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91803.json"