CVE-2026-19931
EUVD-2026-7216606.09.2026, 18:17
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| haxx | curl | 7.64.1 ≤ 𝑥 < 8.22.0 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| curl | curl | 7.64.1 ≤ 𝑥 < 8.14.2 | CNA |
| curl | curl | 8.15.0 ≤ 𝑥 < 8.16.1 | CNA |
| curl | curl | 8.17.0 ≤ 𝑥 < 8.20.1 | CNA |
| curl | curl | 8.21.0 ≤ 𝑥 < 8.22.0 | CNA |
| curl | curl | 8.21.0 | CNA |
| curl | curl | 8.20.0 | CNA |
| curl | curl | 8.19.0 | CNA |
| curl | curl | 8.18.0 | CNA |
| curl | curl | 8.17.0 | CNA |
| curl | curl | 8.16.0 | CNA |
| curl | curl | 8.15.0 | CNA |
| curl | curl | 8.14.1 | CNA |
| curl | curl | 8.14.0 | CNA |
| curl | curl | 8.13.0 | CNA |
| curl | curl | 8.12.1 | CNA |
| curl | curl | 8.12.0 | CNA |
| curl | curl | 8.11.1 | CNA |
| curl | curl | 8.11.0 | CNA |
| curl | curl | 8.10.1 | CNA |
| curl | curl | 8.10.0 | CNA |
| curl | curl | 8.9.1 | CNA |
| curl | curl | 8.9.0 | CNA |
| curl | curl | 8.8.0 | CNA |
| curl | curl | 8.7.1 | CNA |
| curl | curl | 8.7.0 | CNA |
| curl | curl | 8.6.0 | CNA |
| curl | curl | 8.5.0 | CNA |
| curl | curl | 8.4.0 | CNA |
| curl | curl | 8.3.0 | CNA |
| curl | curl | 8.2.1 | CNA |
| curl | curl | 8.2.0 | CNA |
| curl | curl | 8.1.2 | CNA |
| curl | curl | 8.1.1 | CNA |
| curl | curl | 8.1.0 | CNA |
| curl | curl | 8.0.1 | CNA |
| curl | curl | 8.0.0 | CNA |
| curl | curl | 7.88.1 | CNA |
| curl | curl | 7.88.0 | CNA |
| curl | curl | 7.87.0 | CNA |
| curl | curl | 7.86.0 | CNA |
| curl | curl | 7.85.0 | CNA |
| curl | curl | 7.84.0 | CNA |
| curl | curl | 7.83.1 | CNA |
| curl | curl | 7.83.0 | CNA |
| curl | curl | 7.82.0 | CNA |
| curl | curl | 7.81.0 | CNA |
| curl | curl | 7.80.0 | CNA |
| curl | curl | 7.79.1 | CNA |
| curl | curl | 7.79.0 | CNA |
| curl | curl | 7.78.0 | CNA |
| curl | curl | 7.77.0 | CNA |
| curl | curl | 7.76.1 | CNA |
| curl | curl | 7.76.0 | CNA |
| curl | curl | 7.75.0 | CNA |
| curl | curl | 7.74.0 | CNA |
| curl | curl | 7.73.0 | CNA |
| curl | curl | 7.72.0 | CNA |
| curl | curl | 7.71.1 | CNA |
| curl | curl | 7.71.0 | CNA |
| curl | curl | 7.70.0 | CNA |
| curl | curl | 7.69.1 | CNA |
| curl | curl | 7.69.0 | CNA |
| curl | curl | 7.68.0 | CNA |
| curl | curl | 7.67.0 | CNA |
| curl | curl | 7.66.0 | CNA |
| curl | curl | 7.65.3 | CNA |
| curl | curl | 7.65.2 | CNA |
| curl | curl | 7.65.1 | CNA |
| curl | curl | 7.65.0 | CNA |
| curl | curl | 7.64.1 | CNA |
Debian Releases
Ubuntu Releases
Common Weakness Enumeration