Description
libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...
Affected products
haxx: curl
References4
- curl.se/docs/CVE-2026-5545.html PatchVendor Advisory
- curl.se/docs/CVE-2026-5545.json Vendor Advisory
- hackerone.com/reports/3642555 ExploitIssue TrackingThird Party Advisory
- hackerone.com/reports/3642555 ExploitIssue TrackingThird Party Advisory
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N - EPSS — exploit probability
- 0% percentile: 36 · as of 14 November 2026
- CWE
- CWE-305CWE-613
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.