A bug in libcurl allows a Digest-authenticated request to one origin to be followed by a request to a second origin with the same handle, causing libcurl to incorrectly include the first origin’s Authorization header on the second request. This results in the first origin’s credentials being leaked to an unintended party, posing a confidentiality risk. The flaw is categorized as CWE‑201.

The deficiency lies in the libcurl library bundled with the curl project. Any installation that uses libcurl for Digest authentication and reuses the same libcurl handle for a request to a different host is potentially vulnerable. The affected products include any software that incorporates libcurl, such as the curl command-line tool and programs that link against this library, and the RedHat Hummingbird application; specific version details are not supplied, meaning the vulnerability applies to all releases that have not integrated the fix.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of 1% suggests that exploitation is currently unlikely in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires application code that performs Digest authentication against one host and then reuses the same libcurl handle to contact another host, so the likely attack vector is internal or application-level manipulation of libcurl usage.