CVE-2026-86409

None

CVSS

—

EPSS

0.2%

Published

Oct 20, 2026

CISA due date

—

The record

Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information.

Affected packages

Ecosystem	Package	Introduced	Fixed