CVE-2026-5545: wrong reuse of HTTP Negotiate connection
A flaw was found in libcurl. An application using libcurl that performs an authenticated HTTP(S) request after a Negotiate-authenticated one to the same host may incorrectly reuse the previous connection. This authentication bypass vulnerability allows the second request to be sent over a connection authenticated with different credentials, potentially leading to unauthorized access or information disclosure.
Other sources
libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host.
— Launchpad
wrong reuse of HTTP Negotiate connection
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.1-8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.30.3-14 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.14.1-2+deb13u4Fixed in 8.20.0-5Fixed in 8.21.0-2 - Configuration
Avoid using HTTP Negotiate authentication in the application.
libcurl HTTP Negotiate authentication = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5545?
CVE-2026-5545 has a medium severity rating due to potential unauthorized access risks.
How do I fix CVE-2026-5545?
To fix CVE-2026-5545, upgrade to the latest version of libcurl that addresses this vulnerability.
What software is affected by CVE-2026-5545?
CVE-2026-5545 affects certain versions of curl and libcurl between 7.10.6 and 8.20.0.
What is the impact of CVE-2026-5545?
The impact of CVE-2026-5545 can lead to inadvertent reuse of connections, possibly resulting in authentication errors.
How can I determine if I am using a vulnerable version regarding CVE-2026-5545?
To determine if you are using a vulnerable version for CVE-2026-5545, check your libcurl version against the specified affected version range.