CVE-2026-11856: cross-origin Digest auth state leak

Summary:

This issue is the HTTP sibling to the previously disclosed RTSP Digest auth leak. When an application uses libcurl and reuses the same easy handle for sequential transfers (the documented best practice), the Digest authentication state captured from the first origin is silently sent to the next origin. This occurs because Curl_pretransfer() drops the initial_origin but fails to clear data->state.digest between curl_easy_perform() calls. Unlike recently fixed sibling bugs, this leak does not require redirects (-L), .netrc, proxies, or OAuth bearers. Furthermore, explicitly changing credentials via CURLOPT_USERPWD between calls does not prevent the leak, as the new user's password hash is still sent under the previous server's realm and nonce.

Affected version

Reproduced on stock curl 8.7.1 and current master 8.21.0-DEV (81cdf4d), macOS arm64. Backend (SecureTransport/OpenSSL) is irrelevant. Please note that the curl command-line tool is not affected — it calls curl_easy_reset() between transfers. This bug is in libcurl as used by applications that reuse easy handles. As of master 81cdf4d, no open PR or issue addresses this; the closest fixes (6daf4bc7e2 redirect; c1cfdf59ac proxy) only cover their respective trigger paths.

Steps To Reproduce:

The PoC sets up a legitimate server (:19001) that challenges the client, and an attacker server (:19002) that does nothing but log received headers.