Timeline

• Jan 17, 2026 CVE Published
• Jan 17, 2026 PoC Published

References

• libcurl: Improper Authentication State Management on Cross-Protocol Redirects advisory