CVE-2026-19931
Received Received - Intake

HTTP Connection Reuse in libcurl with Negotiate Auth

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: curl

Description
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-08
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-19931
EUVD
EUVD-2026-72166

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
curl libcurl From 7.64.1 (inc) to 8.22.0 (exc)
curl curl From 7.64.1 (inc) to 8.22.0 (exc)
curl libcurl 8.22.0
curl curl 8.22.0
curl curl From 7.64.1 (inc) to 8.21.0 (inc)
curl libcurl *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in libcurl causes it to incorrectly reuse an HTTP connection for a hostname using Negotiate authentication when the initial request is made with empty credentials. This can lead to user B's request being sent over user A's previously authenticated connection. Negotiate authentication treats blank credentials as an ambient user managed externally, but the ambient user can change without libcurl detecting it.

Detection Guidance

To detect this vulnerability, check if your system is running a vulnerable version of curl/libcurl (7.64.1 to 8.21.0). Use commands like 'curl --version' to verify the installed version. Monitor network traffic for improper reuse of authenticated HTTP connections with Negotiate authentication.

Impact Analysis

This flaw may expose sensitive data if an attacker can intercept or manipulate requests sent over a reused authenticated connection. It affects both libcurl and the curl command line tool, potentially leading to unauthorized access to user A's data by user B.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized data exposure. If user B's requests are sent over user A's authenticated connection, sensitive data might be accessed or transmitted without proper authorization, breaching confidentiality requirements in both regulations.

Mitigation Strategies
  • Upgrade curl/libcurl to version 8.22.0 or later immediately.
  • Apply the provided patch if upgrading is not immediately possible.
  • Enable CURLOPT_FORBID_REUSE for transfers using blank credentials as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19931. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart