Cyber Resilience

CVE-2026-9546

Haxx Curl 8.18.0 – 8.21.0

Public PoC
Published
03 July 2026
Modified
07 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0040 33th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-9546 is a high-severity an unspecified weakness vulnerability in Haxx Curl. Its CVSS base score is 7.5 (High).

Operationally, ranked at the 33th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result the previous…

more

referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.

CWE(s)
NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.
Confidence: LOW · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1071.001 Web Protocols Command And Controlconfidence: MEDIUM
Unintended Referer header leakage can disclose sensitive URLs or session context over HTTP.
attack.mitre.org →
inferred from description · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-8932Same product: Haxx Curl
CVE-2025-5399Same product: Haxx Curl
CVE-2026-6429Same product: Haxx Curl
CVE-2025-10966Same product: Haxx Curl
CVE-2026-7009Same product: Haxx Curl
CVE-2025-14017Same product: Haxx Curl
CVE-2025-13034Same product: Haxx Curl
CVE-2024-9681Same product: Haxx Curl
CVE-2026-5545Same product: Haxx Curl
CVE-2026-8924Same product: Haxx Curl

Affected Assets

haxx
curl
8.18.0 — 8.21.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-2 Flaw Remediation
  • AC-4 Information Flow Enforcement
  • SI-15 Information Output Filtering
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly requires timely patching of the libcurl flaw that fails to honor CURLOPT_REFERER=NULL and reuses prior Referer values.

AC-4 Information Flow Enforcement partial match
prevent

Enforces rules on what referrer information may flow in outbound HTTP requests, blocking unintended leakage to third-party servers.

SI-15 Information Output Filtering partial match
prevent

Filters sensitive header content (Referer) before transmission, mitigating the effect of the uncleared internal state.

References