Libcurl contains a state leak that allows a Digest authentication header created for one HTTP origin to be incorrectly reused for a second origin when the same libcurl handle is reused. The flaw enables an attacker who can influence application behavior to cause credentials meant for the initial host to be transmitted to an unintended remote host, exposing authentication secrets and potentially allowing unauthorized access.

Any software that employs libcurl for HTTP communication is affected, including the curl command‑line client and applications that link against libcurl. The RedHat Hummingbird application is a notably affected product but the issue applies to all libcurl releases that have not applied the patch. Exact vulnerable versions are not provided, so all legacy libcurl installations are potentially vulnerable.

The CVSS score of 9.8 reflects critical severity, yet the EPSS score of less than 1% indicates a low probability of exploitation in the wild at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need the ability to control or influence application code that performs Digest authentication to one host and then reuses the same libcurl handle to contact a second host; thus the attack vector is internal or application‑level rather than directly exploitable by external network actors.