CURL-CVE-2026-8458: wrong reuse for different services
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services".
libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.
When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure is limited to applications using libcurl for Negotiate-authenticated requests where requests to the same server use different services and libcurl can reuse a pooled connection.
What does exploitation require?
The supplied vector indicates network reachability, low privileges, and no user interaction. Exploitation is rated low complexity.
What is the expected security impact?
The supplied severity vector rates integrity impact as high. It indicates no confidentiality or availability impact.