A vulnerability in libcurl caused the HTTP Referer: header to persist even
when explicitly cleared. While the documentation states that passing NULL to
CURLOPT_REFERER suppresses the header, the option failed to clear the
internal state. As a result the previous referrer string was erroneously
reused and sent in subsequent requests, potentially leaking sensitive
information to unintended servers.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Curl | Haxx | 8.18.0 (including) | 8.21.0 (excluding) |
| Red Hat Hardened Images | RedHat | curl-main-8.21.0-0.1.hum1 | * |
| Red Hat Hardened Images | RedHat | rust-main-1.96.1-1.hum1 | * |
| Curl | Ubuntu | devel | * |
| Curl | Ubuntu | upstream | * |