Every CVE Search/ Get API key

CVE-2011-2192

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used...

4.3 MediumFix available

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.

Exploit likelihood

2.88%Up 0.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.

Record
CVE-2011-2192
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-255
Updated
2026-11-02
CVE List No score

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.

Record
CVE-2011-2192
Updated
2026-11-02
EUVDEUVD-2011-2183 No score

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.

Record
EUVD-2011-2183
Updated
2026-11-03
GitHub AdvisoriesGHSA-2jvc-33pv-cq2m No score

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used...

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.

Record
GHSA-2jvc-33pv-cq2m
Updated
2026-11-02
OSVCURL-CVE-2011-2192 No score

inappropriate GSSAPI delegation

When doing GSSAPI authentication, libcurl unconditionally performs credential delegation. This hands the server a copy of the client's security credentials, allowing the server to impersonate the client to any other using the same GSSAPI mechanism. This is obviously a sensitive operation, which should only be done when the user explicitly so directs.

The GSS/Negotiate feature is only used by libcurl for HTTP authentication if told to, and only if libcurl was built with a library that provides the GSSAPI. Many builds of libcurl do not have GSS enabled.

Record
CURL-CVE-2011-2192
Updated
2026-11-02
OSV No score

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.

Record
CVE-2011-2192
Updated
2026-11-02
OSVDEBIAN-CVE-2011-2192 No score

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.

Record
DEBIAN-CVE-2011-2192
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Debian:12
 before 7.21.6-2
7.21.6-2
curl
Debian:13
 before 7.21.6-2
7.21.6-2
curl
Debian:14
 before 7.21.6-2
7.21.6-2
curl
Debian:5.0
 before 7.18.2-8lenny5, plus listed versions
7.18.2-87.18.2-8lenny27.18.2-8lenny37.18.2-8lenny4
7.18.2-8lenny5
curl
Debian:6.0
 before 7.21.0-2, plus listed versions
7.21.0-1
7.21.0-2
curl
Red Hat:enterprise_linux:4::as
 before 0:7.12.1-17.el4
0:7.12.1-17.el4
curl-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:7.12.1-17.el4
0:7.12.1-17.el4
curl-devel
Red Hat:enterprise_linux:4::as
 before 0:7.12.1-17.el4
0:7.12.1-17.el4
curl
Red Hat:enterprise_linux:4::desktop
 before 0:7.12.1-17.el4
0:7.12.1-17.el4
curl-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:7.12.1-17.el4
0:7.12.1-17.el4
Show 14 moreShow less
Affected packages
PackageAffectedFixed
curl-devel
Red Hat:enterprise_linux:4::desktop
 before 0:7.12.1-17.el4
0:7.12.1-17.el4
curl
Red Hat:enterprise_linux:4::es
 before 0:7.12.1-17.el4
0:7.12.1-17.el4
curl-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:7.12.1-17.el4
0:7.12.1-17.el4
curl-devel
Red Hat:enterprise_linux:4::es
 before 0:7.12.1-17.el4
0:7.12.1-17.el4
curl
Red Hat:enterprise_linux:4::ws
 before 0:7.12.1-17.el4
0:7.12.1-17.el4
curl-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:7.12.1-17.el4
0:7.12.1-17.el4
curl-devel
Red Hat:enterprise_linux:4::ws
 before 0:7.12.1-17.el4
0:7.12.1-17.el4
curl
Red Hat:enterprise_linux:5::server
 before 0:7.15.5-9.el5_6.3
0:7.15.5-9.el5_6.3
curl-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:7.15.5-9.el5_6.3
0:7.15.5-9.el5_6.3
curl-devel
Red Hat:enterprise_linux:5::server
 before 0:7.15.5-9.el5_6.3
0:7.15.5-9.el5_6.3
curl
Red Hat:enterprise_linux:6::server
 before 0:7.19.7-26.el6_1.1
0:7.19.7-26.el6_1.1
curl-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:7.19.7-26.el6_1.1
0:7.19.7-26.el6_1.1
libcurl
Red Hat:enterprise_linux:6::server
 before 0:7.19.7-26.el6_1.1
0:7.19.7-26.el6_1.1
libcurl-devel
Red Hat:enterprise_linux:6::server
 before 0:7.19.7-26.el6_1.1
0:7.19.7-26.el6_1.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-2192 is a medium vulnerability (CVSS 4.3) in Haxx Libcurl, published June 23, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.88%, the 86th percentile. Fixed in curl 7.21.6-2.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open