CVE-2026-19931
Negotiate ambient user conn reuse
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
| CWE | CWE-488 |
| Vendor | curl |
| Product | curl |
| Published | Sep 6, 2026 |
| Last Updated | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for curl curl
Be the first to know when new critical vulnerabilities affecting curl curl are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
curl / curl
7.64.1 < 8.14.2 8.15.0 < 8.16.1 8.17.0 < 8.20.1 8.21.0 < 8.22.0
curl / curl
6c6035532383e300c712e4c1cd9fdd749ed5cf59 < 7103a93b05bc69ea98ed9d05d02fa9eeba533f2f
curl / curl
8.21.0 8.20.0 8.19.0 8.18.0 8.17.0 8.16.0 8.15.0 8.14.1 8.14.0 8.13.0 8.12.1 8.12.0 8.11.1 8.11.0 8.10.1 8.10.0 8.9.1 8.9.0 8.8.0 8.7.1 8.7.0 8.6.0 8.5.0 8.4.0 8.3.0 8.2.1 8.2.0 8.1.2 8.1.1 8.1.0 8.0.1 8.0.0 7.88.1 7.88.0 7.87.0 7.86.0 7.85.0 7.84.0 7.83.1 7.83.0 7.82.0 7.81.0 7.80.0 7.79.1 7.79.0 7.78.0 7.77.0 7.76.1 7.76.0 7.75.0 7.74.0 7.73.0 7.72.0 7.71.1 7.71.0 7.70.0 7.69.1 7.69.0 7.68.0 7.67.0 7.66.0 7.65.3 7.65.2 7.65.1 7.65.0 7.64.1
References
Credits
Martin Dukek Stefan Eissing