DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-19931: CVE-2026-19931: Unauthenticated Session Reuse Vulnerability in libcurl Negotiate Implementation

#security #cve #cybersecurity

CVE-2026-19931: Unauthenticated Session Reuse Vulnerability in libcurl Negotiate Implementation

Vulnerability ID: CVE-2026-19931
CVSS Score: 9.8
Published: 2026-09-06

A critical connection reuse vulnerability exists in curl and libcurl between versions 7.64.1 and 8.21.0 inclusive when Negotiate authentication (SPNEGO) is configured with blank credentials. Because libcurl fails to track changes to the underlying operating system's ambient security context, persistent authenticated connections are incorrectly matched and shared between distinct user sessions, allowing subsequent users to execute requests with the authorization state of the prior user.

TL;DR

A session reuse vulnerability in libcurl allows requests with blank Negotiate credentials to hijack previously authenticated connections of other users, bypassing server-side authentication controls entirely.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-488 (Exposure of Data Element to Wrong Session)
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 9.8 (Critical)
  • EPSS Score: 0.01162 (Percentile: 65.60%)
  • Exploit Status: Proof-of-Concept / Analysis
  • CISA KEV Status: Not Listed
  • Affected Version Range: 7.64.1 to 8.21.0

Affected Systems

  • curl
  • libcurl
  • Software applications using libcurl for HTTP-based Windows Integrated Authentication (SSPI/GSSAPI)
  • curl: >= 7.64.1, <= 8.21.0 (Fixed in: 8.22.0)
  • libcurl: >= 7.64.1, <= 8.21.0 (Fixed in: 8.22.0)

Code Analysis

Commit: 7103a93

connections: use admin handles only for maintenance

Commit: 6c60355

Move negotiatedata from UrlState to connectdata and preserve Negotiate connections

Exploit Details

  • HackerOne: Original security disclosure highlighting session reuse vulnerabilities in dynamic thread environments

Mitigation Strategies

  • Upgrade libcurl to version 8.22.0 or higher.
  • Programmatically configure CURLOPT_FORBID_REUSE to 1L on all easy handles utilizing Negotiate with blank credentials.
  • Enforce connection isolation or disable Keep-Alive on high-value backend Negotiate endpoints.

Remediation Steps:

  1. Identify all internal applications and systems linking against libcurl versions 7.64.1 through 8.21.0.
  2. Update system packages via the OS package manager or rebuild static libcurl binaries using the 8.22.0 source code.
  3. If binary updates are blocked, implement the CURLOPT_FORBID_REUSE code modification in all active code paths that trigger empty-credential Negotiate requests.
  4. Verify that backend server authentication configurations do not allow session delegation across distinct user contexts over the same connection.

References

Read the full report for CVE-2026-19931 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)