CVE-2026-19931: Negotiate ambient user conn reuse
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using libcurl to make HTTP requests with Negotiate authentication may be exposed when requests for the same hostname use empty credentials and connections are reused across different users.
What conditions are required for exploitation?
An existing HTTP connection must have been authenticated as user A with Negotiate, and a subsequent request from user B must use empty credentials for the same hostname. Libcurl may then send user B's request on user A's authenticated connection.
How can an organization determine whether it may be affected?
Review libcurl usage for HTTP Negotiate authentication, empty credentials, and connection reuse to the same hostname across different user contexts. The relevant risk is whether one user's request can reuse another user's already authenticated connection.