PT-2026-24661 · Libcurl+3 · Libcurl+3
Daniel Stenberg
+1
·
Published
2026-03-11
·
Updated
2026-05-04
·
CVE-2026-1965
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
libcurl (affected versions not specified)
Description
libcurl may reuse an incorrect connection when handling Negotiate-authenticated HTTP or HTTPS requests. This occurs because libcurl maintains a pool of recent connections to avoid overhead. A logical error can cause a request to reuse a connection authenticated with different credentials than expected, as Negotiate sometimes authenticates connections rather than individual requests. Specifically, if an application authenticates with
user1:password1 and then attempts another operation with user2:password2 while the first connection remains active, the second request might incorrectly reuse the connection associated with user1. The authentication methods are configured using the CURLOPT HTTPAUTH option.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Red Os
Ubuntu
Libcurl