Medium [CVE-2026-11856] Information disclosure via incorrect Digest authentication header reuse

Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`. A flaw was found in curl.

This could lead to unintended information disclosure, potentially allowing an attacker to gain unauthorized access to sensitive data. This Moderate-severity flaw in `libcurl` can lead to information disclosure when an application reuses a `libcurl` handle for transfers to different HTTP origins while using Digest authentication.

The vulnerability arises from `libcurl` incorrectly sending the authentication header intended for the initial origin to a subsequent, different origin. This could expose sensitive authentication data to an unintended recipient, potentially compromising user credentials or session information.

Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Hardened Images; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 4 more.