Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H N N 7.5 .0040 33.3 —
AFFECTED Product Versions Fixed curl 8.20.0 – —
TIMELINE May 26 Reserved by curl Jul 3 EXPLOIT PUBLISHED — CVE-2026-9546 (curl). Public exploit reference added. Jul 3 Published (CNA: curl)
A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.
| Date | Event | Detail |
|---|---|---|
| May 26, 2026 | Reserved | Reserved by curl |
| July 3, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-9546 (curl). Public exploit reference added. |
| July 3, 2026 | Published | Published (CNA: curl) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| curl | curl | — | 8.20.0 | — |
Authoritative record: CVE-2026-9546 at cve.org
Vendors: curl
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-9546 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.