by Kastro
Paper/Archive/CVE-2026-19931

CVE-2026-19931

curl curl — Negotiate ambient user conn reuse

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
53
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 66.4.664 × 2013.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

Affected

ProductAffectedFixed inSource
curl7.64.1 – < 8.14.28.14.2CNA
curl8.15.0 – < 8.16.18.16.1CNA
curl8.17.0 – < 8.20.18.20.1CNA
curl8.21.0 – < 8.22.08.22.0CNA
curl6c6035532383e300c712e4c1cd9fdd749ed5cf59 – < 7103a93b05bc69ea98ed9d05d02fa9eeba533f2f7103a93b05bc69ea98ed9d05d02fa9eeba533f2fCNA
curl8.21.0–CNA
curl8.20.0–CNA
curl8.19.0–CNA
curl8.18.0–CNA
curl8.17.0–CNA
curl8.16.0–CNA
curl8.15.0–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refcurl.se/docs/CVE-2026-19931.jsonrefcurl.se/docs/CVE-2026-19931.htmlexploithackerone.com/reports/3923520