The vulnerability resides in libcurl, where the HTTP `Referer:` header is not cleared after being explicitly set to NULL via `CURLOPT_REFERER`. Because the internal state is not reset, the previously supplied referer string is incorrectly reused in subsequent requests, potentially leaking sensitive URLs or other internal information to unintended servers. This behavior matches the information exposure weakness classified as CWE‑201.

Any software that incorporates the libcurl library for HTTP requests may be impacted. The product description only specifies libcurl, meaning that all installations of libcurl that employ the affected code path could be vulnerable until a patch is applied.

The EPSS score is under 1%, indicating a very low exploitation likelihood, while the CVSS score of 7.5 signals moderate‑to‑high severity. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker setting a Referer, clearing it, and thereby causing the leaked Referer to be sent to an attacker‑controlled or unrelated destination. In environments where the Referer header may contain internal or sensitive details, the risk is elevated.