CVE-2026-19931 - Negotiate ambient user conn reuse
Brief
CVE ID : CVE-2026-19931
Published : Sept. 6, 2026, 6:17 p. m.
- 2 hours, 31 minutes ago
Description : A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
Severity: 0.0
- NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...