Description
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
Affected products
haxx: curl
References4
- curl.se/docs/CVE-2026-19931.html PatchVendor Advisory
- curl.se/docs/CVE-2026-19931.json Vendor Advisory
- hackerone.com/reports/3923520 ExploitMitigationThird Party Advisory
- hackerone.com/reports/3923520 ExploitMitigationThird Party Advisory
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 66 · as of 3 November 2026
- CWE
- CWE-488
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.