CVE-2026-19931 — Negotiate ambient user conn reuse
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. …
Published: 2026-09-06 · CVSS: 9.8 · CVSS 3.1
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7