CVE-2026-86409
NONE—CVSS v3
—CVSS v2
0.25%
EPSS (exploit probability)
—CWE
Description
Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,
contrary to expectations and documentation. A subsequent transfer on the same
handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL
isset next, leaking state information.
Affected routers (0)
No routers currently mapped to this CVE in our database.