CVE-2026-1965

Technical Description

libcurl can in some circumstances reuse the wrong connection when asked to do

an Negotiate-authenticated HTTP or HTTPS request.

libcurl features a pool of recent connections so that subsequent requests can

reuse an existing connection to avoid overhead.

When reusing a connection a range of criterion must first be met. Due to a

logical error in the code, a request that was issued by an application could

wrongfully reuse an existing connection to the same server that was

authenticated using different credentials. One underlying reason being that

Negotiate sometimes authenticates *connections* and not *requests*, contrary

to how HTTP is designed to work.

An application that allows Negotiate authentication to a server (that responds

wanting Negotiate) with `user1:password1` and then does another operation to

the same server also using Negotiate but with `user2:password2` (while the

previous connection is still alive) - the second request wrongly reused the

same connection and since it t

Remediation

Check the references section for vendor advisories and patches from haxx. Update curl to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References