A flaw in curl causes the AWS SigV4 authentication setting to persist when disabled on a reused connection handle. If an application then issues a request to an untrusted or attacker-controlled server using that same handle, curl inadvertently sends a signed Authorization header. The result is that an external party can learn the access key identifier and request signature, which can be used to impersonate the AWS identity and potentially access resources. This weakness is catalogued as CWE‑201, the leaking of information from an untrusted source.

The vulnerability applies to the curl library, which is widely used as a command‑line tool and a programming library. No specific affected versions are listed in the public data; any builds that incorporate the affected branch of curl may be susceptible.

The CVSS base score is 5.3, indicating a moderate impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires an attacker to control a server that the vulnerable application will contact via a reused curl handle. The application would need to have disabled SigV4 before reuse, and the attacker must be positioned to receive the accidental Authorization header. While the attack surface is therefore limited, the consequence of credential exposure could be significant.