Description
A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
curl curl
Default version status: unaffected
8.18.0 to < 8.20.1affected
curl curl
Default version status: unaffected
2cb868242dc2ac9cd52ee64987ef51d5964a56f9 to < 862e8a74a84478d82973471b4f49dc2746c1780eaffected
curl curl
Default version status: unaffected
8.20.0affected8.19.0affected8.18.0affected