# CVE-2026-19931

## Summary

- **CVE ID:** CVE-2026-19931
- **Severity:** CRITICAL
- **CVSS Score:** 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** CWE-488
- **Published:** Sep 6, 2026
- **Last Modified:** Sep 16, 2026

## Description

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given
hostname using Negotiate authentication, when the initial request is done
using empty credentials. This can make user B's request get sent over user A's
previously authenticated connection.

## Affected Products

- curl — curl (8.21.0)
- curl — curl (8.20.0)
- curl — curl (8.19.0)
- curl — curl (8.18.0)
- curl — curl (8.17.0)
- curl — curl (8.16.0)
- curl — curl (8.15.0)
- curl — curl (8.14.1)
- curl — curl (8.14.0)
- curl — curl (8.13.0)
- curl — curl (8.12.1)
- curl — curl (8.12.0)
- curl — curl (8.11.1)
- curl — curl (8.11.0)
- curl — curl (8.10.1)
- curl — curl (8.10.0)
- curl — curl (8.9.1)
- curl — curl (8.9.0)
- curl — curl (8.8.0)
- curl — curl (8.7.1)
- curl — curl (8.7.0)
- curl — curl (8.6.0)
- curl — curl (8.5.0)
- curl — curl (8.4.0)
- curl — curl (8.3.0)
- curl — curl (8.2.1)
- curl — curl (8.2.0)
- curl — curl (8.1.2)
- curl — curl (8.1.1)
- curl — curl (8.1.0)
- curl — curl (8.0.1)
- curl — curl (8.0.0)
- curl — curl (7.88.1)
- curl — curl (7.88.0)
- curl — curl (7.87.0)
- curl — curl (7.86.0)
- curl — curl (7.85.0)
- curl — curl (7.84.0)
- curl — curl (7.83.1)
- curl — curl (7.83.0)
- curl — curl (7.82.0)
- curl — curl (7.81.0)
- curl — curl (7.80.0)
- curl — curl (7.79.1)
- curl — curl (7.79.0)
- curl — curl (7.78.0)
- curl — curl (7.77.0)
- curl — curl (7.76.1)
- curl — curl (7.76.0)
- curl — curl (7.75.0)
- curl — curl (7.74.0)
- curl — curl (7.73.0)
- curl — curl (7.72.0)
- curl — curl (7.71.1)
- curl — curl (7.71.0)
- curl — curl (7.70.0)
- curl — curl (7.69.1)
- curl — curl (7.69.0)
- curl — curl (7.68.0)
- curl — curl (7.67.0)
- curl — curl (7.66.0)
- curl — curl (7.65.3)
- curl — curl (7.65.2)
- curl — curl (7.65.1)
- curl — curl (7.65.0)
- curl — curl (7.64.1)
- curl — curl (6c6035532383e300c712e4c1cd9fdd749ed5cf59)

## References

- [CNA](https://curl.se/docs/CVE-2026-19931.json)
- [CNA](https://curl.se/docs/CVE-2026-19931.html)
- [CNA](https://hackerone.com/reports/3923520)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 1.16%
- **EPSS Percentile:** 65.7

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._