CVE-2026-8458: wrong reuse for different services
Last updated 2 July 2026
Other sources
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'.
libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.
When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.21.0-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.1-10
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8458?
CVE-2026-8458 is rated with a risk score of 28.
How do I fix CVE-2026-8458?
To mitigate CVE-2026-8458, update to the latest version of libcurl that addresses the connection reuse issue.
What software is impacted by CVE-2026-8458?
CVE-2026-8458 affects libcurl, particularly in its implementation within Debian/curl.
What is the main issue described in CVE-2026-8458?
CVE-2026-8458 involves the improper reuse of connections for different Negotiate-authenticated services.
When was CVE-2026-8458 published?
CVE-2026-8458 was published on July 3, 2026.