CVE-2026-1965
Connection Reuse Flaw in libcurl Negotiate Authentication Causes Credential Leakage
Publication date: 2026-03-11
Last updated on: 2026-03-12
Assigner: curl
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| haxx | curl | From 7.10.6 (inc) to 8.19.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-305 | The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-1965 is a medium-severity vulnerability in libcurl that occurs due to improper reuse of HTTP Negotiate-authenticated connections. libcurl maintains a pool of recent connections to optimize performance by reusing existing connections for subsequent requests. However, because Negotiate authentication sometimes authenticates entire connections rather than individual requests, libcurl can mistakenly reuse a connection authenticated with one set of credentials (e.g., user1:password1) for a new request intended to use different credentials (e.g., user2:password2) to the same server.
This logical error causes the second request to be sent over a connection still authenticated for the first user, leading to an authentication bypass. The flaw arises when an application uses Negotiate authentication with multiple users on the same server while connections remain alive.
The vulnerability is related to CWE-305: Authentication Bypass by Primary Weakness. It was introduced in a specific commit and fixed in libcurl version 8.19.0 by ensuring connections using Negotiate authentication are only reused if the credentials match.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "This vulnerability can lead to an authentication bypass where a request intended to use one user's credentials is mistakenly sent over a connection authenticated with another user's credentials. This means that sensitive operations could be performed under the wrong user's identity, potentially exposing data or allowing unauthorized actions."}, {'type': 'paragraph', 'content': 'Applications that use Negotiate authentication with multiple users on the same server and rely on connection reuse are at risk. Attackers or unintended users might gain access to resources or perform actions they should not be authorized for, compromising security and trust.'}, {'type': 'paragraph', 'content': 'Mitigation involves disabling connection reuse in libcurl or upgrading to a fixed version (8.19.0 or later) that ensures connections are only reused if credentials match.'}] [1, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves libcurl improperly reusing HTTP Negotiate-authenticated connections with different credentials, which can lead to authentication bypass. Detection would involve monitoring HTTP or HTTPS requests that use Negotiate authentication to the same server with different user credentials while connections remain alive.
Since the issue is related to connection reuse in libcurl, detection could focus on identifying multiple Negotiate-authenticated requests to the same server using different credentials over reused connections.
No specific detection commands are provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': "Immediate mitigation steps include disabling libcurl's reuse of connections when using Negotiate authentication."}, {'type': 'list_item', 'content': 'Use the libcurl option CURLOPT_FRESH_CONNECT to force new connections instead of reusing existing ones.'}, {'type': 'list_item', 'content': 'Adjust CURLOPT_MAXCONNECTS to limit the number of connections libcurl can reuse.'}, {'type': 'list_item', 'content': 'If using the curl_multi API, configure CURLMOPT_MAX_HOST_CONNECTIONS to control connection reuse.'}, {'type': 'list_item', 'content': 'Upgrade libcurl to version 8.19.0 or later, where the vulnerability is fixed.'}, {'type': 'list_item', 'content': 'Alternatively, avoid using HTTP Negotiate authentication if possible.'}] [1, 2]