CVE-2026-9546: sending old referer

Summary:

libcurl documents that CURLOPT_REFERER can be set to NULL to disable the Referer header again, but doing so after a transfer does not clear the cached per-handle referer state. As a result, the next HTTP request on the same easy handle can still send the previous request's Referer: value to a different origin even though the application explicitly cleared it with the documented API.

This is a real cross-request confidentiality problem for applications that pool or reuse easy handles across different jobs, users, or tenants. The easiest