{"id":"CVE-2026-5545","aliases":["ALPINE-CVE-2026-5545","ALSA-2026:80512","AZL-86664","AZL-86928","BELL-CVE-2026-5545","CLSA-2026-1778889816","CLSA-2026-1778890582","CURL-CVE-2026-5545","DEBIAN-CVE-2026-5545","EUVD-2026-29923","GHSA-6g7g-56fm-f8mp","JLSEC-2026-1204","OESA-2026-2451","OESA-2026-2452","OESA-2026-2453","OESA-2026-2454","OESA-2026-2477","RHSA-2026:12916","RHSA-2026:80512","RLSA-2026:80512","ROOT-OS-DEBIAN-11-CVE-2026-5545","ROOT-OS-DEBIAN-12-CVE-2026-5545","ROOT-OS-DEBIAN-13-CVE-2026-5545","SUSE-SU-2026:1717-1","SUSE-SU-2026:1940-1","SUSE-SU-2026:21452-1","SUSE-SU-2026:22146-1","SUSE-SU-2026:22156-1","SUSE-SU-2026:2703-1","SUSE-SU-2026:3798-1","UBUNTU-CVE-2026-5545","openSUSE-SU-2026:10674-1","openSUSE-SU-2026:20973-1"],"status":"published","title":"wrong reuse of HTTP Negotiate connection","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1...","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00414,"percentile":0.35935,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-305","CWE-613"],"published":"2026-04-29T08:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.14.1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.14.1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"curl","fixed_in":["8.11.1-9"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cmake","fixed_in":["3.30.3-14"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.20.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl-minimal","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-devel","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-minimal","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl-minimal","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-devel","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-minimal","fixed_in":["7.76.1-31.el9_2.1.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["8.14.1-2+deb13u4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.20.0~rc2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.20.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.20.0+0"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"curl","fixed_in":["7.74.0-1.3+deb11u16.aikido.18","7.74.0-1.3+deb11u16.aikido.19","7.74.0-1.3+deb11u16.root.io.17"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-curl","fixed_in":["7.74.0-1.3+deb11u16.aikido.18","7.74.0-1.3+deb11u16.aikido.19","7.74.0-1.3+deb11u16.root.io.17"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"curl","fixed_in":["7.88.1-10+deb12u14.root.io.11","7.88.1-10+deb12u14.root.io.10","7.88.1-10+deb12u15.aikido.13","7.88.1-10+deb12u15.aikido.14","7.88.1-10+deb12u15.aikido.15","7.88.1-10+deb12u15.aikido.16","7.88.1-10+deb12u15.aikido.17","7.88.1-10+deb12u15.aikido.18","7.88.1-10+deb12u15.aikido.19","7.88.1-10+deb12u15.aikido.20"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-curl","fixed_in":["7.88.1-10+deb12u14.root.io.11","7.88.1-10+deb12u14.root.io.10","7.88.1-10+deb12u15.aikido.13","7.88.1-10+deb12u15.aikido.14","7.88.1-10+deb12u15.aikido.15","7.88.1-10+deb12u15.aikido.16","7.88.1-10+deb12u15.aikido.17","7.88.1-10+deb12u15.aikido.18","7.88.1-10+deb12u15.aikido.19","7.88.1-10+deb12u15.aikido.20"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"curl","fixed_in":["7.68.0-1ubuntu2.25+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"curl","fixed_in":["7.81.0-1ubuntu1.24"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"curl","fixed_in":["8.5.0-2ubuntu10.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"curl","fixed_in":["8.14.1-2ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"curl","fixed_in":["8.18.0-1ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.10.6"},{"fixed":"8.14.1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.10.6"},{"fixed":"8.14.1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.10.6"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.10.6"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.1-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.3-14"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0-r2"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.14.0-r1"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.20.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.88.1-10","7.88.1-10+deb12u1","7.88.1-10+deb12u11","7.88.1-10+deb12u12","7.88.1-10+deb12u13","7.88.1-10+deb12u14","7.88.1-10+deb12u15","7.88.1-10+deb12u1~bpo11+1","7.88.1-10+deb12u2","7.88.1-10+deb12u3","7.88.1-10+deb12u3~bpo11+1","7.88.1-10+deb12u4","7.88.1-10+deb12u5","7.88.1-10+deb12u5~bpo11+1","7.88.1-10+deb12u6","7.88.1-10+deb12u6~bpo11+1","7.88.1-10+deb12u7","7.88.1-10+deb12u8","7.88.1-10+deb12u9","7.88.1-11","8.0.1-1~exp1","8.10.0-1","8.10.0-2","8.10.1-1","8.10.1-1~bpo12+1","8.10.1-2","8.11.0-1","8.11.1-1","8.11.1-1~bpo12+1","8.12.0+git20250209.89ed161+ds-1","8.12.0+git20250209.89ed161+ds-1~bpo12+1","8.12.1-1","8.12.1-2","8.12.1-2~bpo12+1","8.12.1-3","8.12.1-3~bpo12+1","8.13.0-1","8.13.0-1+exp1","8.13.0-2","8.13.0-2+exp1","8.13.0-3","8.13.0-4","8.13.0-4+exp1","8.13.0-5","8.13.0-5+exp1","8.13.0-5~bpo12+1","8.13.0~rc-1~exp1","8.13.0~rc-1~exp2","8.13.0~rc2-1","8.13.0~rc2-2","8.13.0~rc3-1","8.13.0~rc3-1+exp1","8.14.0-1","8.14.0-1+exp1","8.14.0~rc1-1+exp1","8.14.0~rc2-1+exp1","8.14.0~rc3-1+exp1","8.14.1-1","8.14.1-1~bpo12+1","8.14.1-2","8.14.1-2+exp1","8.14.1-2~bpo12+1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.2.1-1","8.2.1-2","8.2.1-2~bpo12+1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0-1","8.21.0-1+exp1","8.21.0-2","8.21.0-2+exp1","8.21.0-2~bpo13+1","8.21.0~rc1-1+exp1","8.21.0~rc2-1","8.21.0~rc2-1+exp1","8.21.0~rc3-1","8.21.0~rc3-1+exp1","8.22.0-1","8.22.0-1+exp1","8.22.0~rc2-1","8.22.0~rc2-2","8.22.0~rc3-1","8.22.0~rc3-1+exp1","8.23.0~rc1-1","8.23.0~rc1-2","8.23.0~rc2-1","8.23.0~rc2-1+exp1","8.3.0-1","8.3.0-2","8.3.0-2~bpo12+1","8.3.0-2~exp1","8.3.0-3","8.4.0-1","8.4.0-2","8.4.0-2~bpo12+1","8.5.0-1","8.5.0-1+exp1","8.5.0-2","8.5.0-2+exp1","8.5.0-2~bpo12+1","8.6.0-1","8.6.0-1.1","8.6.0-2","8.6.0-3","8.6.0-3.1","8.6.0-3.1~exp1","8.6.0-3.1~exp2","8.6.0-3.2","8.6.0-4","8.7.1-1","8.7.1-1+exp1","8.7.1-2","8.7.1-3","8.7.1-4","8.7.1-5","8.7.1-5+exp1","8.7.1-5~bpo12+1","8.8.0-1","8.8.0-1+exp1","8.8.0-1+exp2","8.8.0-1~bpo12+1","8.8.0-2","8.8.0-3","8.8.0-4","8.9.0-1","8.9.0-2","8.9.0-3","8.9.1-1","8.9.1-2","8.9.1-2~bpo12+1"]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2+deb13u4"}]}],"versions":["8.14.1-2","8.14.1-2+deb13u1","8.14.1-2+deb13u2","8.14.1-2+deb13u2~bpo13+1","8.14.1-2+deb13u3"]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20.0~rc2-1"}]}],"versions":["8.14.1-2","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3"]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.20.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.20.0+0"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-49.oe2203sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-29.oe2403"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-29.oe2403sp3"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-48.oe2003sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-30.oe2403sp1"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.20.0-0.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.20.0-0.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.20.0-0.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.20.0-0.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-4.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:Debian:11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3+deb11u16.aikido.18"},{"fixed":"7.74.0-1.3+deb11u16.aikido.19"},{"fixed":"7.74.0-1.3+deb11u16.root.io.17"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3+deb11u16.aikido.18"},{"fixed":"7.74.0-1.3+deb11u16.aikido.19"},{"fixed":"7.74.0-1.3+deb11u16.root.io.17"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u14.root.io.11"},{"fixed":"7.88.1-10+deb12u14.root.io.10"},{"fixed":"7.88.1-10+deb12u15.aikido.13"},{"fixed":"7.88.1-10+deb12u15.aikido.14"},{"fixed":"7.88.1-10+deb12u15.aikido.15"},{"fixed":"7.88.1-10+deb12u15.aikido.16"},{"fixed":"7.88.1-10+deb12u15.aikido.17"},{"fixed":"7.88.1-10+deb12u15.aikido.18"},{"fixed":"7.88.1-10+deb12u15.aikido.19"},{"fixed":"7.88.1-10+deb12u15.aikido.20"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-10+deb12u14.root.io.11"},{"fixed":"7.88.1-10+deb12u14.root.io.10"},{"fixed":"7.88.1-10+deb12u15.aikido.13"},{"fixed":"7.88.1-10+deb12u15.aikido.14"},{"fixed":"7.88.1-10+deb12u15.aikido.15"},{"fixed":"7.88.1-10+deb12u15.aikido.16"},{"fixed":"7.88.1-10+deb12u15.aikido.17"},{"fixed":"7.88.1-10+deb12u15.aikido.18"},{"fixed":"7.88.1-10+deb12u15.aikido.19"},{"fixed":"7.88.1-10+deb12u15.aikido.20"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.123.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150700.7.23.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.25+esm5"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5","7.68.0-1ubuntu2.6","7.68.0-1ubuntu2.7","7.68.0-1ubuntu2.10","7.68.0-1ubuntu2.11","7.68.0-1ubuntu2.12","7.68.0-1ubuntu2.13","7.68.0-1ubuntu2.14","7.68.0-1ubuntu2.15","7.68.0-1ubuntu2.16","7.68.0-1ubuntu2.18","7.68.0-1ubuntu2.19","7.68.0-1ubuntu2.20","7.68.0-1ubuntu2.21","7.68.0-1ubuntu2.22","7.68.0-1ubuntu2.23","7.68.0-1ubuntu2.24","7.68.0-1ubuntu2.25","7.68.0-1ubuntu2.25+esm2","7.68.0-1ubuntu2.25+esm3","7.68.0-1ubuntu2.25+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.24"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1","7.81.0-1ubuntu1.1","7.81.0-1ubuntu1.2","7.81.0-1ubuntu1.3","7.81.0-1ubuntu1.4","7.81.0-1ubuntu1.6","7.81.0-1ubuntu1.7","7.81.0-1ubuntu1.8","7.81.0-1ubuntu1.10","7.81.0-1ubuntu1.11","7.81.0-1ubuntu1.13","7.81.0-1ubuntu1.14","7.81.0-1ubuntu1.15","7.81.0-1ubuntu1.16","7.81.0-1ubuntu1.17","7.81.0-1ubuntu1.18","7.81.0-1ubuntu1.19","7.81.0-1ubuntu1.20","7.81.0-1ubuntu1.21","7.81.0-1ubuntu1.22","7.81.0-1ubuntu1.23"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-2ubuntu10.9"}]}],"versions":["8.2.1-1ubuntu3","8.2.1-1ubuntu3.1","8.4.0-2ubuntu1","8.5.0-2ubuntu1","8.5.0-2ubuntu2","8.5.0-2ubuntu8","8.5.0-2ubuntu9","8.5.0-2ubuntu10","8.5.0-2ubuntu10.1","8.5.0-2ubuntu10.2","8.5.0-2ubuntu10.3","8.5.0-2ubuntu10.4","8.5.0-2ubuntu10.5","8.5.0-2ubuntu10.6","8.5.0-2ubuntu10.7","8.5.0-2ubuntu10.8"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2ubuntu1.3"}]}],"versions":["8.12.1-3ubuntu1","8.13.0-5ubuntu1","8.14.1-1ubuntu2","8.14.1-1ubuntu3","8.14.1-2ubuntu1","8.14.1-2ubuntu1.1","8.14.1-2ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.0-1ubuntu2.1"}]}],"versions":["8.14.1-2ubuntu1","8.17.0-1ubuntu1","8.18.0-1ubuntu1","8.18.0-1ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20.0-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.6.1"}]}],"bundled":5}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"}],"references":[{"url":"https://curl.se/docs/CVE-2026-5545.json","tags":["Vendor Advisory","web"]},{"url":"https://curl.se/docs/CVE-2026-5545.html","tags":["Patch","Vendor Advisory","web","article","report"]},{"url":"https://hackerone.com/reports/3642555","tags":["exploit","Exploit","Issue Tracking","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5545","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6g7g-56fm-f8mp","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-5545","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80512","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-10536","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5545","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6253","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6429","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7168","tags":["report"]},{"url":"https://bugzilla.redhat.com/2461202","tags":["report"]},{"url":"https://bugzilla.redhat.com/2461204","tags":["report"]},{"url":"https://bugzilla.redhat.com/2461205","tags":["report"]},{"url":"https://bugzilla.redhat.com/2476979","tags":["report"]},{"url":"https://bugzilla.redhat.com/2496766","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-80512.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-5545","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1778889816.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778890582.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5545.json","tags":["advisory"]},{"url":"https://github.com/curl/curl.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-5545","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2451","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5773","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6276","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6429","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7168","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2452","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2453","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2454","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2477","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:12916","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6276","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5773","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4873","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_12916.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461200","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4873","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-4873.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461204","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5545","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461201","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5773","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-5773.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461202","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6253","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-6253.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461203","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6276","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-6276.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461205","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6429","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-6429.html","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496766","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80512.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7168","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/29/14","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-7168.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-7168.json","tags":["article"]},{"url":"https://hackerone.com/reports/3697719","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-10536","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10536","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-10536.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-10536.json","tags":["article"]},{"url":"https://hackerone.com/reports/3751697","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:80512","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261717-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259362","tags":["report"]},{"url":"https://bugzilla.suse.com/1262631","tags":["report"]},{"url":"https://bugzilla.suse.com/1262632","tags":["report"]},{"url":"https://bugzilla.suse.com/1262635","tags":["report"]},{"url":"https://bugzilla.suse.com/1262636","tags":["report"]},{"url":"https://bugzilla.suse.com/1262638","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6429","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261940-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621452-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622146-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622156-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262703-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262633","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5773","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263798-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1263440","tags":["report"]},{"url":"https://bugzilla.suse.com/1268412","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8926","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-5545","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8227-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8525-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-5545","title":"wrong reuse of HTTP Negotiate connection","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1...","status":"published","published":"2026-05-13T08:27:26.065Z","modified":"2026-09-15T06:02:59.285Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T13:39:27.849196Z"}],"euvd":[{"id":"EUVD-2026-29923","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1...","status":"published","published":"2026-05-13T08:27:26Z","modified":"2026-09-15T06:02:59Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:19.01786Z"}],"ghsa":[{"id":"GHSA-6g7g-56fm-f8mp","title":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated...","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1...","status":"published","published":"2026-05-13T18:30:52Z","modified":"2026-09-15T09:30:27Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-305","CWE-613"],"updated_at":"2026-11-02T15:11:53.5286Z"}],"nvd":[{"id":"CVE-2026-5545","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1...","status":"published","published":"2026-05-13T13:01:56.19Z","modified":"2026-09-15T07:16:28.633Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-305","CWE-613"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"ALPINE-CVE-2026-5545","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1...","status":"published","published":"2026-05-13T13:01:56.19Z","modified":"2026-10-18T12:30:04.112589967Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-5545","status":"published","published":"2026-05-01T06:09:38.63786Z","modified":"2026-05-15T07:19:34.191072Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-5545","title":"wrong reuse of HTTP Negotiate connection","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1...","status":"published","published":"2026-05-13T08:27:26.065Z","modified":"2026-10-28T11:14:53.365039199Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"DEBIAN-CVE-2026-5545","description":"libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host.  libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.  When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials.  An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...","status":"published","published":"2026-05-13T13:01:56.19Z","modified":"2026-10-01T03:03:18.89379744Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"JLSEC-2026-1204","title":"libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated...","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1...","status":"published","published":"2026-08-07T20:11:58.984Z","modified":"2026-08-07T20:28:38.933114681Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-2451","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.(CVE-2026-4873)\n\nlibcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0026apos;s and user2\u0026apos;s credentials when it is in fact\nstill using the connection authenticated for user1...(CVE-2026-5545)\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \u0026apos;share\u0026apos; than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.(CVE-2026-5773)\n\ncurl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy(CVE-2026-6253)\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.(CVE-2026-6276)\n\nWhen asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.(CVE-2026-6429)\n\nSuccessfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.(CVE-2026-7168)","status":"published","published":"2026-05-22T11:11:24Z","modified":"2026-08-18T01:19:59.385572992Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2452","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.(CVE-2026-4873)\n\nlibcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0026apos;s and user2\u0026apos;s credentials when it is in fact\nstill using the connection authenticated for user1...(CVE-2026-5545)\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \u0026apos;share\u0026apos; than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.(CVE-2026-5773)\n\ncurl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy(CVE-2026-6253)\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.(CVE-2026-6276)\n\nWhen asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.(CVE-2026-6429)\n\nSuccessfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.(CVE-2026-7168)","status":"published","published":"2026-05-22T11:11:24Z","modified":"2026-08-18T01:20:00.173223473Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2453","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.(CVE-2026-4873)\n\nlibcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0026apos;s and user2\u0026apos;s credentials when it is in fact\nstill using the connection authenticated for user1...(CVE-2026-5545)\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \u0026apos;share\u0026apos; than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.(CVE-2026-5773)\n\ncurl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy(CVE-2026-6253)\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.(CVE-2026-6276)\n\nWhen asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.(CVE-2026-6429)\n\nSuccessfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.(CVE-2026-7168)","status":"published","published":"2026-05-22T11:11:24Z","modified":"2026-08-18T01:20:00.167468481Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2454","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.(CVE-2026-4873)\n\nlibcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0026apos;s and user2\u0026apos;s credentials when it is in fact\nstill using the connection authenticated for user1...(CVE-2026-5545)\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \u0026apos;share\u0026apos; than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.(CVE-2026-5773)\n\ncurl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy(CVE-2026-6253)\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.(CVE-2026-6276)\n\nWhen asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.(CVE-2026-6429)\n\nSuccessfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.(CVE-2026-7168)","status":"published","published":"2026-05-22T11:11:24Z","modified":"2026-08-18T01:20:00.207520282Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2477","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.(CVE-2026-4873)\n\nlibcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0026apos;s and user2\u0026apos;s credentials when it is in fact\nstill using the connection authenticated for user1...(CVE-2026-5545)\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \u0026apos;share\u0026apos; than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.(CVE-2026-5773)\n\ncurl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy(CVE-2026-6253)\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.(CVE-2026-6276)\n\nWhen asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.(CVE-2026-6429)\n\nSuccessfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.(CVE-2026-7168)","status":"published","published":"2026-05-29T11:11:26Z","modified":"2026-08-18T01:20:00.949425098Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:12916","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-03T10:03:35Z","modified":"2026-10-15T10:12:44Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:80512","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2026-10-14T10:31:49Z","modified":"2026-10-15T10:28:00Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:80512","title":"Moderate: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies (CVE-2026-6253)\n\n* curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse (CVE-2026-5545)\n\n* curl: libcurl: Credential leak via reused proxy connection during HTTP redirects (CVE-2026-6429)\n\n* curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse (CVE-2026-7168)\n\n* libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service (CVE-2026-10536)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-15T00:08:46.966634Z","modified":"2026-10-15T00:30:02.672952336Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-5545","title":"CVE-2026-5545 in curl - Patched by Root","description":"Root has patched CVE-2026-5545 in the curl package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-20T12:49:54Z","modified":"2026-08-20T13:30:05.229714235Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-5545","title":"CVE-2026-5545 in curl - Patched by Root","description":"Root has patched CVE-2026-5545 in the curl package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-11-04T06:00:50Z","modified":"2026-11-04T07:15:08.030696331Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-04T07:32:10.855619Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-5545","title":"CVE-2026-5545 in rootio-curl - Patched by Root","description":"Root has patched CVE-2026-5545 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-07-10T15:43:44Z","modified":"2026-07-13T14:00:21.245592688Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"UBUNTU-CVE-2026-5545","description":"libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...","status":"published","published":"2026-04-29T14:00:00Z","modified":"2026-07-11T00:29:33.123888175Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"ALSA-2026:80512","title":"Moderate: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.  \n\nSecurity Fix(es):  \n\n  * curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies (CVE-2026-6253)\n  * curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse (CVE-2026-5545)\n  * curl: libcurl: Credential leak via reused proxy connection during HTTP redirects (CVE-2026-6429)\n  * curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse (CVE-2026-7168)\n  * libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service (CVE-2026-10536)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-29T11:30:08.644938407Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-86664","title":"CVE-2026-5545 affecting package curl for versions less than 8.11.1-9","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1...","status":"published","published":"2026-05-13T13:01:56Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.190302Z"},{"id":"AZL-86928","title":"CVE-2026-5545 affecting package cmake for versions less than 3.30.3-14","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1...","status":"published","published":"2026-05-13T13:01:56Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.190302Z"},{"id":"CLSA-2026-1778889816","title":"curl: Fix of CVE-2026-5545","description":"- CVE-2026-5545: wrong reuse of HTTP Negotiate connection; only allow an\n  existing connection to be reused and \"upgraded\" to NTLM when neither\n  NTLM nor Negotiate authentication is in flight on it","status":"published","published":"2026-05-16T00:03:41Z","modified":"2026-06-01T00:32:52.806780363Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778890582","title":"curl: Fix of CVE-2026-5545","description":"- CVE-2026-5545: wrong reuse of HTTP Negotiate connection; only allow an\n  existing connection to be reused and \"upgraded\" to NTLM when neither\n  NTLM nor Negotiate authentication is in flight on it","status":"published","published":"2026-05-16T00:16:27Z","modified":"2026-06-01T00:32:31.36857485Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CURL-CVE-2026-5545","title":"wrong reuse of HTTP Negotiate connection","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1...","status":"published","published":"2026-04-29T08:00:00Z","modified":"2026-10-25T01:05:42.648125055Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"openSUSE-SU-2026:10674-1","title":"curl-8.20.0-1.1 on GA media","description":"These are all security issues fixed in the curl-8.20.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-04T00:00:00Z","modified":"2026-05-05T07:46:40.778646Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20973-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n","status":"published","published":"2026-06-17T08:47:34Z","modified":"2026-06-24T18:24:21.071415239Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:1717-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n\nOther updates and bugfixes:\n\n- sws: prevent 'connection monitor' to say disconnect twice (bsc#1259362).\n","status":"published","published":"2026-05-06T12:13:54Z","modified":"2026-05-07T08:46:21.899858Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1940-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n\nOther updates and bugfixes:\n\n- sws: prevent 'connection monitor' to say disconnect twice (bsc#1259362).\n","status":"published","published":"2026-05-18T07:44:20Z","modified":"2026-05-19T08:45:08.261772469Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:21452-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n\nOther updates and bugfixes:\n\n- sws: prevent \"connection monitor\" to say disconnect twice (bsc#1259362).\n","status":"published","published":"2026-04-30T14:46:10Z","modified":"2026-05-05T18:23:55.855178Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:22146-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n","status":"published","published":"2026-06-17T08:57:16Z","modified":"2026-06-19T18:24:06.180348168Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22156-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n","status":"published","published":"2026-06-17T08:57:16Z","modified":"2026-06-24T18:24:22.566714968Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2703-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n","status":"published","published":"2026-06-30T10:27:48Z","modified":"2026-07-01T09:45:07.290337429Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:3798-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).\n- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).\n- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n","status":"published","published":"2026-08-25T12:41:04Z","modified":"2026-08-27T11:01:49.76472582Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}