CVE-2026-19931

Published: Sep 6, 2026Modified: Sep 15, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

Affected (1)

Products: Haxx: Curl

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Haxx Curl	7.64.1 ≤ version < 8.22.0

Related CWEs

Exposure of Data Element to Wrong Session

The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

References (4)

https://curl.se/docs/CVE-2026-19931.html

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

PatchVendor Advisory

https://curl.se/docs/CVE-2026-19931.json

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Vendor Advisory

https://hackerone.com/reports/3923520

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

ExploitMitigationThird Party Advisory

https://hackerone.com/reports/3923520

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationThird Party Advisory

Timeline

No history available yet.