Timeline

• Apr 19, 2026 CVE Published
• Apr 19, 2026 PoC Published

References

• libcurl omits IPv6 zoneid from host identity and leaks credentials/cookies across scoped link-local realms advisory