CURL-CVE-2026-19931: Negotiate ambient user conn reuse
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using libcurl that make HTTP requests to the same hostname with Negotiate authentication and reuse connections may be exposed. The issue concerns requests initially made with empty credentials.
What does an attacker need to exploit this?
An attacker does not need privileges or user interaction according to the provided vector. Exploitation depends on causing a request from user B to use user A's previously authenticated HTTP connection for the same hostname.
What is the potential impact?
User B's request can be sent over user A's authenticated connection. The provided severity vector rates confidentiality, integrity, and availability impact as high.