curl / Docs / curl CVEs / Negotiate ambient user conn reuse
Related:
Audits
Changelog
curl CVEs
JSON metadata
Original report
Vulnerability Disclosure
Vulnerabilities Table

CVE-2026-19931

Negotiate ambient user conn reuse

Project curl Security Advisory, September 2 2026 Permalink

VULNERABILITY

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

INFO

For Negotiate authentication, libcurl treats blank credentials special: as an ambient user whose credentials are held outside libcurl's knowledge by the auth provider (SSPI on Windows, or the GSSAPI library elsewhere).

It turns out the ambient user can also change for a blank-credentials setup (behind the back, impossible for libcurl to spot).

This bug is not considered a C mistake (likely to have been avoided had we not been using C).

This flaw also affects the curl command line tool.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-19931 to this issue.

CWE-488: Exposure of Data Element to Wrong Session

Severity: Medium

AFFECTED VERSIONS

SOLUTION

RECOMMENDATIONS

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade curl and libcurl to version 8.22.0

B - Apply the patch to your version and rebuild

C - Enable CURLOPT_FORBID_REUSE for transfers using blank credentials.

TIMELINE

This issue was reported to the curl project on August 7, 2026.

curl 8.22.0 was released on September 2 2026, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!