CVE-2026-19931

9.8 Critique

Publiée le 06/09/2026 à 20:17 · Modifiée le 15/09/2026 à 09:16 · Modifiée · Source : 2499f714-1537-4658-8207-48ae4bb9eae9

Description

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

Traduire en français

Produits concernés

curl
Haxx curl

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-488

Références

https://curl.se/docs/CVE-2026-19931.html PatchVendor Advisory
https://curl.se/docs/CVE-2026-19931.json Vendor Advisory
https://hackerone.com/reports/3923520 ExploitMitigationThird Party Advisory
https://hackerone.com/reports/3923520 ExploitMitigationThird Party Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories