CVE-2026-19931

A flaw was found in libcurl. This vulnerability allows an attacker to reuse an HTTP connection set up for a given hostname using Negotiate authentication. When an initial request is made with empty credentials, a subsequent user's request can be sent over a previously authenticated connection...

AZL-99777 CVE-2026-19931 affecting package cmake 3.30.3-15

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

AZL-99792 CVE-2026-19931 affecting package mysql 8.0.46-1

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

AZL-99752 CVE-2026-19931 affecting package curl 8.11.1-11

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

AZL-99870 CVE-2026-19931 affecting package tensorflow 2.16.1-11

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

AZL-99819 CVE-2026-19931 affecting package rust 1.75.0-30

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

CVE-2026-19931

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

ALPINE-CVE-2026-19931

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

AZL-99843 CVE-2026-19931 affecting package rust 1.90.0-10

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

EUVD-2026-72166

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

CVE-2026-19931 Negotiate ambient user conn reuse

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

CVE-2026-19931 Negotiate ambient user conn reuse

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

CVE-2026-19931

libcurl (versions 7.64.1 through 8.21.x ) contains a connection-reuse flaw in its Negotiate authentication handling. When an initial request is made with empty credentials, a subsequent request from a different user can be sent over the first user's already-authenticated connection, resulting in ...

CVE-2026-19931

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

curl: libcurl: Information disclosure via incorrect connection reuse with Negotiate authentication

A flaw was found in libcurl. This vulnerability allows an attacker to reuse an HTTP connection set up for a given hostname using Negotiate authentication. When an initial request is made with empty credentials, a subsequent user's request can be sent over a previously authenticated connection...

libcurl 7.64.1 < 8.22.0 Negotiate Ambient User Connection Reuse

The version of libcurl installed on the remote host is 7.64.1 prior to 8.22.0. It is, therefore, affected by an information disclosure vulnerability: - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request i...

Curl 7.64.1 < 8.22.0 Negotiate Ambient User Connection Reuse

The version of curl installed on the remote host is 7.64.1 prior to 8.22.0. It is, therefore, affected by an information disclosure vulnerability: - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is...

Negotiate ambient user conn reuse

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

CURL-CVE-2026-19931 Negotiate ambient user conn reuse

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

PT-2026-84652

Name of the Vulnerable Software and Affected Versions libcurl affected versions not specified Description A flaw exists where the software incorrectly reuses an HTTP connection setup for a specific hostname when using Negotiate authentication, specifically when the initial request is made with...