CVE-2026-5545: wrong reuse of HTTP Negotiate connection
Last updated 10 July 2026
Other sources
libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host.
— Launchpad
wrong reuse of HTTP Negotiate connection
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.1-8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.30.3-14 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.14.1-2+deb13u4Fixed in 8.20.0-5Fixed in 8.21.0-2 - Configuration
Avoid using HTTP Negotiate in your application. The issue is triggered when an authenticated HTTP(S) request using a non-Negotiate authentication method is performed after a Negotiate-authenticated request while the previous connection to the same host is still alive.
application using libcurl (HTTP/S client) HTTP authentication scheme usage (Negotiate) = disabled (avoid HTTP Negotiate) - Compensating control
Do not perform an authenticated HTTP(S) request after a Negotiate-authenticated one to the same host while connection reuse is possible (e.g., ensure the Negotiate-authenticated connection is not reused for the subsequent request).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5545?
CVE-2026-5545 has a medium severity rating due to potential unauthorized access risks.
How do I fix CVE-2026-5545?
To fix CVE-2026-5545, upgrade to the latest version of libcurl that addresses this vulnerability.
What software is affected by CVE-2026-5545?
CVE-2026-5545 affects certain versions of curl and libcurl between 7.10.6 and 8.20.0.
What is the impact of CVE-2026-5545?
The impact of CVE-2026-5545 can lead to inadvertent reuse of connections, possibly resulting in authentication errors.
How can I determine if I am using a vulnerable version regarding CVE-2026-5545?
To determine if you are using a vulnerable version for CVE-2026-5545, check your libcurl version against the specified affected version range.