CVE-2026-19931

Modified Modified - Updated After Analysis

HTTP Connection Reuse in libcurl with Negotiate Auth

Publication date: 2026-09-06

Last updated on: 2026-09-15

Assigner: curl

Description

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-06

Last Modified

2026-09-15

Generated

2026-09-28

AI Q&A

2026-09-06

EPSS Evaluated

2026-09-27

NVD

CVE-2026-19931

EUVD

EUVD-2026-72166

Affected Vendors & Products

Vendor	Product	Version / Range
haxx	curl	From 7.64.1 (inc) to 8.22.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-488	The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

Attack-Flow Graph

Executive Summary

This vulnerability in libcurl causes it to incorrectly reuse an HTTP connection for a hostname using Negotiate authentication when the initial request is made with empty credentials. This can lead to user B's request being sent over user A's previously authenticated connection. Negotiate authentication treats blank credentials as an ambient user managed externally, but the ambient user can change without libcurl detecting it.

Detection Guidance

To detect this vulnerability, check if your system is running a vulnerable version of curl/libcurl (7.64.1 to 8.21.0). Use commands like 'curl --version' to verify the installed version. Monitor network traffic for improper reuse of authenticated HTTP connections with Negotiate authentication.

Impact Analysis

This flaw may expose sensitive data if an attacker can intercept or manipulate requests sent over a reused authenticated connection. It affects both libcurl and the curl command line tool, potentially leading to unauthorized access to user A's data by user B.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized data exposure. If user B's requests are sent over user A's authenticated connection, sensitive data might be accessed or transmitted without proper authorization, breaching confidentiality requirements in both regulations.

Mitigation Strategies

Upgrade curl/libcurl to version 8.22.0 or later immediately.
Apply the provided patch if upgrading is not immediately possible.
Enable CURLOPT_FORBID_REUSE for transfers using blank credentials as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-19931. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70