Skip to main content

libcurl CVE-2026-19931

| EUVDEUVD-2026-72166 CRITICAL
Exposure of Data Element to Wrong Session (CWE-488)
2026-09-02 GHSA-rhw6-3rrg-mwjq
Information Disclosure Red Hat Curl Haxx
Critical
Disputed · 9.8 Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Access shared libcurl proxy/service
  2. Delivery
    Victim authenticates via Negotiate connection
  3. Exploit
    Empty-credential request marks connection reusable
  4. Execution
    Attacker request reuses victim's connection
  5. Persist
    Request executes under victim's identity
  6. Impact
    Access victim's protected resources

Vulnerability Assessment

Weakness
CWE
CWE-488
ASVS 5.0
V14 - Data Protection Exposure of data element to wrong session
Exploitation Conditions

Requires a deployment where a single libcurl instance/connection cache is shared across multiple users or requests (e.g., a proxy, gateway, or multi-tenant service), the target host uses HTTP Negotiate (SPNEGO/Kerberos) authentication, and an initial request to that hostname is issued with empty credentials - that empty-credential initial request is the exact trigger that makes libcurl wrongly mark the connection reusable. Exploitation is inherently limited to such shared-connection contexts: a single-user curl invocation or any deployment not using Negotiate auth is not affected, and the attacker must also win the connection-reuse race so their request lands on the victim's authenticated connection.
Impact

The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) substantially overstates real-world risk and is internally inconsistent with the described mechanism. This is a session-confusion/confidentiality problem - a victim's authenticated connection is reused for another party's request - with no plausible availability impact, so A:H is unsupported and I:H is at best a secondary effect (a request executed under someone else's authentication). Exploitation is also not low-complexity: it requires a shared libcurl instance servicing multiple principals (e.g., a forward proxy, gateway, or multi-tenant service), Negotiate auth in use, an initial empty-credential request, and favorable connection-reuse timing - collectively AC:H rather than AC:L. The corroborating low EPSS (0.26%) and absence of KEV/POC align with this: it is a real correctness/security bug worth patching but not a mass-exploitation priority. No SSVC decision data was provided. Note also a reference inconsistency (see confidence_notes) that should be reconciled with the vendor advisory.
Exploit ScenarioDerived

A multi-user gateway or forward proxy uses a shared libcurl connection pool to reach an internal service protected by Negotiate/Kerberos. User A authenticates and libcurl caches the connection; because an initial empty-credential request made it eligible for reuse, user B's subsequent request to the same host is dispatched over A's already-authenticated connection, so B's request executes with A's identity and can read or act on A's protected resources. No public exploit code is identified at time of analysis, and success depends on the specific reuse timing and a shared-handle deployment.
Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.
1 PoC candidate (unverified) Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 08, 2026

Cross-user session confusion in libcurl allows one user's HTTP request to be silently transmitted over another user's previously authenticated Negotiate (SPNEGO/Kerberos) connection. When an initial request to a host is made with empty credentials, libcurl incorrectly treats the resulting connection as eligible for reuse, so a subsequent request from a different principal inherits the earlier authenticated context. There is no public exploit identified at time of analysis; EPSS is low (0.26%, 17th percentile), and the flaw is only meaningful in multi-user or proxy-style deployments that share a single libcurl handle/connection pool.

Earlier versions of this analysis (1)
v1 Sep 02, 2026 - 12:20

Negotiate (SPNEGO/Kerberos) ambient credential leakage in curl allows an attacker-controlled server to receive authentication tokens intended for a different, legitimate server via improper connection reuse. Affected are curl and libcurl through version 8.21.0 when Negotiate authentication is active and connection reuse occurs across different servers. No public exploit code has been identified and this does not appear in CISA KEV; the issue was patched in the coordinated curl 8.22.0 security release on September 2, 2026.

RemediationAI

Patch available per vendor advisory (https://curl.se/docs/CVE-2026-19931.html); the exact fixed release is not stated in the provided data, so confirm the patched version directly from the curl advisory before pinning (affected range extends through 8.21.0, so the fix is in the subsequent release). Because libcurl is frequently vendored/statically linked, also update any application, container image, or appliance firmware that bundles its own copy rather than relying on the OS package. If immediate upgrade is not possible, compensating controls for at-risk multi-user/proxy deployments include disabling HTTP Negotiate authentication where it is not strictly required (removing the vulnerable code path entirely, at the cost of falling back to another auth scheme), and avoiding sharing a single libcurl handle or connection pool across distinct users/principals - instantiate per-user handles or disable connection reuse (CURLOPT_FRESH_CONNECT / forbid reuse) for Negotiate traffic, accepting the performance cost of additional TCP/TLS handshakes.

Affected VersionsENISA

curl 8.17.0 ≤8.17.0
curl 8.18.0 ≤8.18.0
curl 8.5.0 ≤8.5.0
curl 7.71.1 ≤7.71.1
curl 7.65.2 ≤7.65.2
curl 8.2.0 ≤8.2.0
curl 8.0.1 ≤8.0.1
curl 7.69.0 ≤7.69.0
curl 7.68.0 ≤7.68.0
curl 7.65.0 ≤7.65.0
curl 8.1.1 ≤8.1.1
curl 7.81.0 ≤7.81.0
curl 7.88.1 ≤7.88.1
curl 7.82.0 ≤7.82.0
curl 7.79.0 ≤7.79.0
curl 7.88.0 ≤7.88.0
curl 8.4.0 ≤8.4.0
curl 7.65.3 ≤7.65.3
curl 7.65.1 ≤7.65.1
curl 7.76.0 ≤7.76.0
curl 8.16.0 ≤8.16.0
curl 8.15.0 ≤8.15.0
curl 7.71.0 ≤7.71.0
curl 7.84.0 ≤7.84.0
curl 8.21.0 ≤8.21.0
curl 7.73.0 ≤7.73.0
curl 8.14.0 ≤8.14.0
curl 8.9.1 ≤8.9.1
curl 7.72.0 ≤7.72.0
curl 8.1.0 ≤8.1.0
curl 7.78.0 ≤7.78.0
curl 8.10.1 ≤8.10.1
curl 8.3.0 ≤8.3.0
curl 8.20.0 ≤8.20.0
curl 7.69.1 ≤7.69.1
curl 8.9.0 ≤8.9.0
curl 8.7.1 ≤8.7.1
curl 7.83.1 ≤7.83.1
curl 7.66.0 ≤7.66.0
curl 8.7.0 ≤8.7.0
curl 7.87.0 ≤7.87.0
curl 7.77.0 ≤7.77.0
curl 7.70.0 ≤7.70.0
curl 8.12.0 ≤8.12.0
curl 8.6.0 ≤8.6.0
curl 7.76.1 ≤7.76.1
curl 7.67.0 ≤7.67.0
curl 7.79.1 ≤7.79.1
curl 7.80.0 ≤7.80.0
curl 7.74.0 ≤7.74.0
curl 7.85.0 ≤7.85.0
curl 8.19.0 ≤8.19.0
curl 8.14.1 ≤8.14.1
curl 8.11.1 ≤8.11.1
curl 8.8.0 ≤8.8.0
curl 7.86.0 ≤7.86.0
curl 8.11.0 ≤8.11.0
curl 7.75.0 ≤7.75.0
curl 7.64.1 ≤7.64.1
curl 7.83.0 ≤7.83.0
curl 8.12.1 ≤8.12.1
curl 8.2.1 ≤8.2.1
curl 8.10.0 ≤8.10.0
curl 8.13.0 ≤8.13.0
curl 8.0.0 ≤8.0.0
curl 8.1.2 ≤8.1.2

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libcurl is the transfer library underpinning the curl CLI and is embedded in a vast range of applications, language runtimes, and appliances. The issue lives in libcurl's connection-reuse (connection cache) logic for HTTP Negotiate authentication. Negotiate is a stateful, connection-bound auth scheme: once a connection is authenticated for a user, that authentication state persists for the life of the TCP connection. The root cause is CWE-488 (Exposure of Data Element to Wrong Session): libcurl fails to key the reuse decision correctly when the initiating request carried empty credentials, so it matches a later request to a connection that is already bound to a different user's authenticated session. The affected code path is exercised only when Negotiate auth and connection reuse are both in play against the same hostname.

Know when Curl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (CNA) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 6.5 MEDIUM

AC:H because it needs a shared multi-user libcurl context, Negotiate auth, an empty-credential initial request, and reuse timing; primary impact is confidentiality (C:H), a request under another's identity gives limited I:L, and no availability impact (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat 6.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Updated
Sep 08, 2026 - 16:30 vuln.today
v2 - CVSS changed
CVSS changed
Sep 08, 2026 - 16:22 NVD
9.8 (CRITICAL)
CVE Published
Sep 02, 2026 - 10:57 oss-security
CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Credential Leakage in OpenSSL/curl via SPNEGO - CVE-2026-19931 Sep 03, 2026

Technical POC Analysis

The flaw is CWE-488: Exposure of Data Element to Wrong Session.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Sign in to read

Latest POC

1 PoC candidate from github (unverified)

Sign in to open the public PoC links collected for this CVE.

Sign in to read

Executive ViewAI

Why It Matters

libcurl versions prior to mitigation contain a cross-user session confusion vulnerability (CVSS 9.8) where HTTP requests from one authenticated user can be silently transmitted over another user's Negotiate (Kerberos/SPNEGO) connection. This affects organizations using libcurl in multi-user applications or proxy deployments that share connection pools, potentially exposing confidential data and enabling unauthorized actions in the authenticated session.

Business Impact: High
Compensating Controls

Isolate libcurl contexts per user/principal to prevent connection reuse across authentication boundaries; disable connection pooling in multi-user deployments; implement network-layer access controls to restrict inter-user request paths; avoid proxy-style architectures that centralize connection management across multiple users until patched.

Threat Intelligence Overview

EPSS Score
0.3%
Top 83% exploitable
Prevalence
Ubiquitous
libcurl is embedded in countless applications, runtimes, and appliances
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC Yes
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity + public POC available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

69
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Curl

View all
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32206 MEDIUM POC
6.5 Jul 07

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2022-43551 HIGH POC
7.5 Dec 23

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2022-32205 MEDIUM POC
4.3 Jul 07

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re

Same weakness CWE-488 – Exposure of Data Element to Wrong Session

View all
CVE-2024-38367 CRITICAL POC
9.6
CVE-2024-27935 HIGH POC
8.3
CVE-2026-88017 HIGH POC
7.3
CVE-2026-16498 CRITICAL
10.0
CVE-2026-16326 CRITICAL
10.0
CVE-2026-86411 CRITICAL
9.1
CVE-2024-27455 CRITICAL
9.1
CVE-2026-71850 MEDIUM POC
4.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

References

Advisories & patches
ADVISORY https://curl.se/docs/CVE-2026-80256.html ADVISORY https://curl.se/docs/vuln-8.21.0.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-19931 ADVISORY https://rock-solid.curl.dev ADVISORY https://seclists.org/oss-sec/2026/q3/637 ADVISORY https://vuldb.com/vuln/399475 REF https://curl.se/docs/CVE-2026-19931.html REF https://curl.se/docs/CVE-2026-19931.json REF https://hackerone.com/reports/3923520

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy