CVE-2026-19931

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

Scoring

Severity

CRITICAL

CVSS base score

9.8

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability

1.16%

CWE

CWE-488

Published

2026-09-06

Last modified

2026-09-16

Affected products

• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl

Weakness type

• CWE-488

Related vulnerabilities

• CVE-2025-47928 — Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`
• CVE-2026-16498 — terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
• CVE-2026-16326 — consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
• CVE-2024-38367 — CoacoaPods trunk sessions verification step could be manipulated for owner session hijacking
• CVE-2023-1907 — Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong session
• CVE-2024-6162 — Undertow: url-encoded request path information can be broken on ajp-listener
• CVE-2024-5148 — Gnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificate
• CVE-2024-41977 — A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM

Markdown version · Browse all CVEs