187 matches found
curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication
A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the...
CLEANSTART-2026-DQ34657 go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP
CVE-2026-32952 affects multiple packages. go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. See references for individual vulnerability details...
CLEANSTART-2026-MG86208 go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP
CVE-2026-32952 affects multiple packages. go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. See references for individual vulnerability details...
CVE-2026-94265
When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...
ALPINE-CVE-2026-94265
When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...
DEBIAN-CVE-2026-94265
When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...
CVE-2026-94265
When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...
CVE-2026-94265 Authorization: Negotiate sent to foreign origin
When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...
CVE-2026-94265
When processing an HTTP redirect to a URL containing userinfo a "username:password" component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl...
EUVD-2026-105353
When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...
ALPINE-CVE-2026-86413
When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...
DEBIAN-CVE-2026-86413
When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...
CVE-2026-86413
When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...
CVE-2026-86413
When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...
CVE-2026-86413
When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...
EUVD-2026-105279
When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...
CVE-2026-86413
The curl utility is vulnerable to a credential leakage flaw when using an ambient user during a first transfer utilizing Negotiate authentication . If the client is instructed to follow redirects, it may incorrectly pass its credential details to an unrelated second origin. This vulnerability is ...
CVE-2026-86413
When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...
CVE-2026-86413 Negotiate credentials sent to redirected origin
When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...
CVE-2026-86413 Negotiate credentials sent to redirected origin
When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...