Using libcurl to transfer to a specific HTTP origin (hostA) with Digest authentication, then changing the origin to a different one (hostB) for a second transfer while reusing the same handle, causes libcurl to incorrectly pass the Authorization header intended for hostA to hostB. This results in disclosure of Digest authentication credentials across origins, allowing an attacker who can control the application to gain unauthorized access to hostB, exposing authentication secrets and enabling unauthorized access on the second host. This represents improper authentication (CWE-294) and improper authorization (CWE-201).

Any software that employs libcurl for HTTP communication is affected, including the curl command‑line client and applications that link against libcurl. The RedHat Hummingbird application is a notably affected product but the issue applies to all libcurl releases that have not applied the patch. Exact vulnerable versions are not provided, so all legacy libcurl installations are potentially vulnerable.

The CVSS score of 9.8 reflects critical severity, yet the EPSS score of less than 1% indicates a low probability of exploitation in the wild at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need the ability to control or influence application code that performs Digest authentication to one host and then reuses the same libcurl handle to contact a second host; thus the attack vector is internal or application‑level rather than directly exploitable by external network actors.