Most recent entries from all

bdu:2026-09771

BELL-CVE-2026-5545

Affected: Alpaquita:23: curl, Alpaquita:25: curl, Alpaquita:stream: curl, BellSoft Hardened Containers:stream: curl

certfr-2026-avi-0514 — De multiples vulnérabilités ont été découvertes dans Curl. Elles permettent à un attaquant de provoquer une atteinte à…

certfr-2026-avi-0514

EUVD-2026-368414

fkie_cve-2026-5545

libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host.

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials.

An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...

GHSA-6g7g-56fm-f8mp

libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host.

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

msrc_CVE-2026-5545 — wrong reuse of HTTP Negotiate connection

msrc_CVE-2026-5545

OESA-2026-2451 — curl security update

Affected: openEuler:22.03-LTS-SP4: curl

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols. Security Fix(es):

A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.(CVE-2026-4873)

libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host.

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

openSUSE-SU-2026:10674-1 — curl-8.20.0-1.1 on GA media

curl-8.20.0-1.1 on GA media

RHSA-2026:12916 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

curl: curl: Information disclosure due to incorrect TLS connection reuse curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers curl: libcurl: Credential leak via reused proxy connection during HTTP redirects

SUSE-SU-2026:1940-1 — Security update for curl

Security update for curl

UBUNTU-CVE-2026-5545

Affected: Ubuntu:Pro:20.04:LTS: curl, Ubuntu:22.04:LTS: curl, Ubuntu:24.04:LTS: curl, Ubuntu:25.10: curl, Ubuntu:26.04:LTS: curl

libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...

WID-SEC-W-2026-1307 — cURL: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.