The vulnerability in the curl library causes an opt‑in AWS Signature Version 4 (SigV4) authentication setting to persist even after it is disabled, because setting CURLOPT_AWS_SIGV4 to NULL does not clear the authentication state. A subsequent request performed with the same easy handle inadvertently sends an "Authorization: AWS4‑HMAC‑SHA256" header to whatever URL the handle next contacts. This exposes the AWS access key identifier and request signature to an attacker that controls the next target, allowing the attacker to impersonate the AWS identity or use the leaked credentials. The weakness is cataloged as CWE‑201, a data disclosure flaw.

The flaw applies to the curl library (curl:curl), which is widely used as a command‑line tool and a programming library. No specific affected versions are listed in the public data; any builds that incorporate the affected branch of curl may be susceptible.

The CVSS base score is 8.1, indicating a high severity. The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to control the next server that the vulnerable application will contact via a reused curl handle that has been previously configured to use SigV4, and the application must have disabled the SigV4 option before reuse. While the attack surface is limited to reused handles, the leakage of credentials could enable credential theft and subsequent unauthorized access to AWS resources.