curl: libcurl: Information disclosure via incorrect connection reuse with Negotiate authentication

A flaw was found in libcurl. This vulnerability allows an attacker to reuse an HTTP connection set up for a given hostname using Negotiate authentication. When an initial request is made with empty credentials, a subsequent user's request can be sent over a previously authenticated connection...

jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously...

SUSE-SU-2026:3958-1 Security update for curl

This update for curl fixes the following issues: - CVE-2026-5773: wrong reuse of SMB connection bsc1262633. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8926: password leak with netrc and user in URL bsc1268412. - CVE-2026-13608: flow in OpenLDAP SASL negotiation can...

curl: curl: Incorrect HTTPS connection reuse with Native CA Store

A flaw was found in libcurl. This vulnerability allows libcurl to incorrectly reuse an existing HTTPS connection for a given hostname, even when a different Native CA Store setting CURLSSLOPTNATIVECA is specified for the new connection. This could potentially lead to a client trusting a malicious...

libcurl 7.64.1 < 8.22.0 Negotiate Ambient User Connection Reuse

The version of libcurl installed on the remote host is 7.64.1 prior to 8.22.0. It is, therefore, affected by an information disclosure vulnerability: - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request i...

Curl 7.64.1 < 8.22.0 Negotiate Ambient User Connection Reuse

The version of curl installed on the remote host is 7.64.1 prior to 8.22.0. It is, therefore, affected by an information disclosure vulnerability: - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is...

Negotiate ambient user conn reuse

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

CURL-CVE-2026-19931 Negotiate ambient user conn reuse

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

native CA store conn reuse

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...

CURL-CVE-2026-80231 native CA store conn reuse

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...

PT-2026-84652

Name of the Vulnerable Software and Affected Versions libcurl affected versions not specified Description A flaw exists where the software incorrectly reuses an HTTP connection setup for a specific hostname when using Negotiate authentication, specifically when the initial request is made with...

PT-2026-84656

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description A flaw in libcurl causes the software to incorrectly reuse an existing HTTPS connection setup for a specific hostname, even if a different Native CA Store setting CURLSSLOPT NATIVE CA is used...

EUVD-2026-66376

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open...

Alibaba Cloud Linux 3 : 0278: curl (ALINUX3-SA-2026:0278)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0278 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-8286: A vulnerability exists where a new...

TencentOS Server 3: curl (TSSA-2026:0910)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0910 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:3798-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3798-1 advisory. - CVE-2026-5545: wrong reuse of HTTP Negotiate connection bsc1262632. - CVE-2026-5773: wrong reuse of SMB...

SUSE-SU-2026:23361-1 Security update for curl

This update for curl fixes the following issues: - CVE-2026-5773: wrong reuse of SMB connection bsc1262633. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8926: password leak with netrc and user in URL bsc1268412. Changes for curl: - Call httpsize first to prioritize...

Security update for curl

This update for curl fixes the following issues: CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. CVE-2026-8458: wrong reuse for different services bsc1268407. CVE-2026-8924: traling dot domain super cookie bsc1268409...

CVE-2026-19538

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open...

DEBIAN-CVE-2026-19538

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open...