CVE-2026-5545 (GCVE-0-2026-5545)
Vulnerability from cvelistv5
Published
2026-05-13 08:27
Modified
2026-09-15 06:02
CWE
  • CWE-305 - Authentication Bypass by Primary Weakness
Summary
libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...
Impacted products
Vendor Product Version
curl curl Version: 7.10.6   ≤
Version: 8.15.0   ≤
Version: 8.17.0   ≤
Create a notification for this product.
   curl curl Version: e56ae1426cb7a0a4a427cf8d6099a821fdaae428
Create a notification for this product.
   curl curl Version: 8.19.0
Version: 8.18.0
Version: 8.17.0
Version: 8.16.0
Version: 8.15.0
Version: 8.14.1
Version: 8.14.0
Version: 8.13.0
Version: 8.12.1
Version: 8.12.0
Version: 8.11.1
Version: 8.11.0
Version: 8.10.1
Version: 8.10.0
Version: 8.9.1
Version: 8.9.0
Version: 8.8.0
Version: 8.7.1
Version: 8.7.0
Version: 8.6.0
Version: 8.5.0
Version: 8.4.0
Version: 8.3.0
Version: 8.2.1
Version: 8.2.0
Version: 8.1.2
Version: 8.1.1
Version: 8.1.0
Version: 8.0.1
Version: 8.0.0
Version: 7.88.1
Version: 7.88.0
Version: 7.87.0
Version: 7.86.0
Version: 7.85.0
Version: 7.84.0
Version: 7.83.1
Version: 7.83.0
Version: 7.82.0
Version: 7.81.0
Version: 7.80.0
Version: 7.79.1
Version: 7.79.0
Version: 7.78.0
Version: 7.77.0
Version: 7.76.1
Version: 7.76.0
Version: 7.75.0
Version: 7.74.0
Version: 7.73.0
Version: 7.72.0
Version: 7.71.1
Version: 7.71.0
Version: 7.70.0
Version: 7.69.1
Version: 7.69.0
Version: 7.68.0
Version: 7.67.0
Version: 7.66.0
Version: 7.65.3
Version: 7.65.2
Version: 7.65.1
Version: 7.65.0
Version: 7.64.1
Version: 7.64.0
Version: 7.63.0
Version: 7.62.0
Version: 7.61.1
Version: 7.61.0
Version: 7.60.0
Version: 7.59.0
Version: 7.58.0
Version: 7.57.0
Version: 7.56.1
Version: 7.56.0
Version: 7.55.1
Version: 7.55.0
Version: 7.54.1
Version: 7.54.0
Version: 7.53.1
Version: 7.53.0
Version: 7.52.1
Version: 7.52.0
Version: 7.51.0
Version: 7.50.3
Version: 7.50.2
Version: 7.50.1
Version: 7.50.0
Version: 7.49.1
Version: 7.49.0
Version: 7.48.0
Version: 7.47.1
Version: 7.47.0
Version: 7.46.0
Version: 7.45.0
Version: 7.44.0
Version: 7.43.0
Version: 7.42.1
Version: 7.42.0
Version: 7.41.0
Version: 7.40.0
Version: 7.39.0
Version: 7.38.0
Version: 7.37.1
Version: 7.37.0
Version: 7.36.0
Version: 7.35.0
Version: 7.34.0
Version: 7.33.0
Version: 7.32.0
Version: 7.31.0
Version: 7.30.0
Version: 7.29.0
Version: 7.28.1
Version: 7.28.0
Version: 7.27.0
Version: 7.26.0
Version: 7.25.0
Version: 7.24.0
Version: 7.23.1
Version: 7.23.0
Version: 7.22.0
Version: 7.21.7
Version: 7.21.6
Version: 7.21.5
Version: 7.21.4
Version: 7.21.3
Version: 7.21.2
Version: 7.21.1
Version: 7.21.0
Version: 7.20.1
Version: 7.20.0
Version: 7.19.7
Version: 7.19.6
Version: 7.19.5
Version: 7.19.4
Version: 7.19.3
Version: 7.19.2
Version: 7.19.1
Version: 7.19.0
Version: 7.18.2
Version: 7.18.1
Version: 7.18.0
Version: 7.17.1
Version: 7.17.0
Version: 7.16.4
Version: 7.16.3
Version: 7.16.2
Version: 7.16.1
Version: 7.16.0
Version: 7.15.5
Version: 7.15.4
Version: 7.15.3
Version: 7.15.2
Version: 7.15.1
Version: 7.15.0
Version: 7.14.1
Version: 7.14.0
Version: 7.13.2
Version: 7.13.1
Version: 7.13.0
Version: 7.12.3
Version: 7.12.2
Version: 7.12.1
Version: 7.12.0
Version: 7.11.2
Version: 7.11.1
Version: 7.11.0
Version: 7.10.8
Version: 7.10.7
Version: 7.10.6
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-5545",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T17:46:36.115262Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T17:46:40.830Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3642555"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.10.6",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.20.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "33e43985b8f3b9e66691d06e70be0395849856cd",
              "status": "affected",
              "version": "e56ae1426cb7a0a4a427cf8d6099a821fdaae428",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.19.0"
            },
            {
              "status": "affected",
              "version": "8.18.0"
            },
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            },
            {
              "status": "affected",
              "version": "7.86.0"
            },
            {
              "status": "affected",
              "version": "7.85.0"
            },
            {
              "status": "affected",
              "version": "7.84.0"
            },
            {
              "status": "affected",
              "version": "7.83.1"
            },
            {
              "status": "affected",
              "version": "7.83.0"
            },
            {
              "status": "affected",
              "version": "7.82.0"
            },
            {
              "status": "affected",
              "version": "7.81.0"
            },
            {
              "status": "affected",
              "version": "7.80.0"
            },
            {
              "status": "affected",
              "version": "7.79.1"
            },
            {
              "status": "affected",
              "version": "7.79.0"
            },
            {
              "status": "affected",
              "version": "7.78.0"
            },
            {
              "status": "affected",
              "version": "7.77.0"
            },
            {
              "status": "affected",
              "version": "7.76.1"
            },
            {
              "status": "affected",
              "version": "7.76.0"
            },
            {
              "status": "affected",
              "version": "7.75.0"
            },
            {
              "status": "affected",
              "version": "7.74.0"
            },
            {
              "status": "affected",
              "version": "7.73.0"
            },
            {
              "status": "affected",
              "version": "7.72.0"
            },
            {
              "status": "affected",
              "version": "7.71.1"
            },
            {
              "status": "affected",
              "version": "7.71.0"
            },
            {
              "status": "affected",
              "version": "7.70.0"
            },
            {
              "status": "affected",
              "version": "7.69.1"
            },
            {
              "status": "affected",
              "version": "7.69.0"
            },
            {
              "status": "affected",
              "version": "7.68.0"
            },
            {
              "status": "affected",
              "version": "7.67.0"
            },
            {
              "status": "affected",
              "version": "7.66.0"
            },
            {
              "status": "affected",
              "version": "7.65.3"
            },
            {
              "status": "affected",
              "version": "7.65.2"
            },
            {
              "status": "affected",
              "version": "7.65.1"
            },
            {
              "status": "affected",
              "version": "7.65.0"
            },
            {
              "status": "affected",
              "version": "7.64.1"
            },
            {
              "status": "affected",
              "version": "7.64.0"
            },
            {
              "status": "affected",
              "version": "7.63.0"
            },
            {
              "status": "affected",
              "version": "7.62.0"
            },
            {
              "status": "affected",
              "version": "7.61.1"
            },
            {
              "status": "affected",
              "version": "7.61.0"
            },
            {
              "status": "affected",
              "version": "7.60.0"
            },
            {
              "status": "affected",
              "version": "7.59.0"
            },
            {
              "status": "affected",
              "version": "7.58.0"
            },
            {
              "status": "affected",
              "version": "7.57.0"
            },
            {
              "status": "affected",
              "version": "7.56.1"
            },
            {
              "status": "affected",
              "version": "7.56.0"
            },
            {
              "status": "affected",
              "version": "7.55.1"
            },
            {
              "status": "affected",
              "version": "7.55.0"
            },
            {
              "status": "affected",
              "version": "7.54.1"
            },
            {
              "status": "affected",
              "version": "7.54.0"
            },
            {
              "status": "affected",
              "version": "7.53.1"
            },
            {
              "status": "affected",
              "version": "7.53.0"
            },
            {
              "status": "affected",
              "version": "7.52.1"
            },
            {
              "status": "affected",
              "version": "7.52.0"
            },
            {
              "status": "affected",
              "version": "7.51.0"
            },
            {
              "status": "affected",
              "version": "7.50.3"
            },
            {
              "status": "affected",
              "version": "7.50.2"
            },
            {
              "status": "affected",
              "version": "7.50.1"
            },
            {
              "status": "affected",
              "version": "7.50.0"
            },
            {
              "status": "affected",
              "version": "7.49.1"
            },
            {
              "status": "affected",
              "version": "7.49.0"
            },
            {
              "status": "affected",
              "version": "7.48.0"
            },
            {
              "status": "affected",
              "version": "7.47.1"
            },
            {
              "status": "affected",
              "version": "7.47.0"
            },
            {
              "status": "affected",
              "version": "7.46.0"
            },
            {
              "status": "affected",
              "version": "7.45.0"
            },
            {
              "status": "affected",
              "version": "7.44.0"
            },
            {
              "status": "affected",
              "version": "7.43.0"
            },
            {
              "status": "affected",
              "version": "7.42.1"
            },
            {
              "status": "affected",
              "version": "7.42.0"
            },
            {
              "status": "affected",
              "version": "7.41.0"
            },
            {
              "status": "affected",
              "version": "7.40.0"
            },
            {
              "status": "affected",
              "version": "7.39.0"
            },
            {
              "status": "affected",
              "version": "7.38.0"
            },
            {
              "status": "affected",
              "version": "7.37.1"
            },
            {
              "status": "affected",
              "version": "7.37.0"
            },
            {
              "status": "affected",
              "version": "7.36.0"
            },
            {
              "status": "affected",
              "version": "7.35.0"
            },
            {
              "status": "affected",
              "version": "7.34.0"
            },
            {
              "status": "affected",
              "version": "7.33.0"
            },
            {
              "status": "affected",
              "version": "7.32.0"
            },
            {
              "status": "affected",
              "version": "7.31.0"
            },
            {
              "status": "affected",
              "version": "7.30.0"
            },
            {
              "status": "affected",
              "version": "7.29.0"
            },
            {
              "status": "affected",
              "version": "7.28.1"
            },
            {
              "status": "affected",
              "version": "7.28.0"
            },
            {
              "status": "affected",
              "version": "7.27.0"
            },
            {
              "status": "affected",
              "version": "7.26.0"
            },
            {
              "status": "affected",
              "version": "7.25.0"
            },
            {
              "status": "affected",
              "version": "7.24.0"
            },
            {
              "status": "affected",
              "version": "7.23.1"
            },
            {
              "status": "affected",
              "version": "7.23.0"
            },
            {
              "status": "affected",
              "version": "7.22.0"
            },
            {
              "status": "affected",
              "version": "7.21.7"
            },
            {
              "status": "affected",
              "version": "7.21.6"
            },
            {
              "status": "affected",
              "version": "7.21.5"
            },
            {
              "status": "affected",
              "version": "7.21.4"
            },
            {
              "status": "affected",
              "version": "7.21.3"
            },
            {
              "status": "affected",
              "version": "7.21.2"
            },
            {
              "status": "affected",
              "version": "7.21.1"
            },
            {
              "status": "affected",
              "version": "7.21.0"
            },
            {
              "status": "affected",
              "version": "7.20.1"
            },
            {
              "status": "affected",
              "version": "7.20.0"
            },
            {
              "status": "affected",
              "version": "7.19.7"
            },
            {
              "status": "affected",
              "version": "7.19.6"
            },
            {
              "status": "affected",
              "version": "7.19.5"
            },
            {
              "status": "affected",
              "version": "7.19.4"
            },
            {
              "status": "affected",
              "version": "7.19.3"
            },
            {
              "status": "affected",
              "version": "7.19.2"
            },
            {
              "status": "affected",
              "version": "7.19.1"
            },
            {
              "status": "affected",
              "version": "7.19.0"
            },
            {
              "status": "affected",
              "version": "7.18.2"
            },
            {
              "status": "affected",
              "version": "7.18.1"
            },
            {
              "status": "affected",
              "version": "7.18.0"
            },
            {
              "status": "affected",
              "version": "7.17.1"
            },
            {
              "status": "affected",
              "version": "7.17.0"
            },
            {
              "status": "affected",
              "version": "7.16.4"
            },
            {
              "status": "affected",
              "version": "7.16.3"
            },
            {
              "status": "affected",
              "version": "7.16.2"
            },
            {
              "status": "affected",
              "version": "7.16.1"
            },
            {
              "status": "affected",
              "version": "7.16.0"
            },
            {
              "status": "affected",
              "version": "7.15.5"
            },
            {
              "status": "affected",
              "version": "7.15.4"
            },
            {
              "status": "affected",
              "version": "7.15.3"
            },
            {
              "status": "affected",
              "version": "7.15.2"
            },
            {
              "status": "affected",
              "version": "7.15.1"
            },
            {
              "status": "affected",
              "version": "7.15.0"
            },
            {
              "status": "affected",
              "version": "7.14.1"
            },
            {
              "status": "affected",
              "version": "7.14.0"
            },
            {
              "status": "affected",
              "version": "7.13.2"
            },
            {
              "status": "affected",
              "version": "7.13.1"
            },
            {
              "status": "affected",
              "version": "7.13.0"
            },
            {
              "status": "affected",
              "version": "7.12.3"
            },
            {
              "status": "affected",
              "version": "7.12.2"
            },
            {
              "status": "affected",
              "version": "7.12.1"
            },
            {
              "status": "affected",
              "version": "7.12.0"
            },
            {
              "status": "affected",
              "version": "7.11.2"
            },
            {
              "status": "affected",
              "version": "7.11.1"
            },
            {
              "status": "affected",
              "version": "7.11.0"
            },
            {
              "status": "affected",
              "version": "7.10.8"
            },
            {
              "status": "affected",
              "version": "7.10.7"
            },
            {
              "status": "affected",
              "version": "7.10.6"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Quac Tran and Ngoc Hieu"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Stefan Eissing"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0027s and user2\u0027s credentials when it is in fact\nstill using the connection authenticated for user1..."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-305",
              "description": "Authentication Bypass by Primary Weakness",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:02:59.285Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2026-5545.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-5545.html"
        },
        {
          "url": "https://hackerone.com/reports/3642555"
        }
      ],
      "title": "wrong reuse of HTTP Negotiate connection",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.10.6"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.20.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "e56ae1426cb7a0a4a427cf8d6099a821fdaae428"
                  },
                  {
                    "fixed": "33e43985b8f3b9e66691d06e70be0395849856cd"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.19.0",
              "8.18.0",
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0",
              "7.87.0",
              "7.86.0",
              "7.85.0",
              "7.84.0",
              "7.83.1",
              "7.83.0",
              "7.82.0",
              "7.81.0",
              "7.80.0",
              "7.79.1",
              "7.79.0",
              "7.78.0",
              "7.77.0",
              "7.76.1",
              "7.76.0",
              "7.75.0",
              "7.74.0",
              "7.73.0",
              "7.72.0",
              "7.71.1",
              "7.71.0",
              "7.70.0",
              "7.69.1",
              "7.69.0",
              "7.68.0",
              "7.67.0",
              "7.66.0",
              "7.65.3",
              "7.65.2",
              "7.65.1",
              "7.65.0",
              "7.64.1",
              "7.64.0",
              "7.63.0",
              "7.62.0",
              "7.61.1",
              "7.61.0",
              "7.60.0",
              "7.59.0",
              "7.58.0",
              "7.57.0",
              "7.56.1",
              "7.56.0",
              "7.55.1",
              "7.55.0",
              "7.54.1",
              "7.54.0",
              "7.53.1",
              "7.53.0",
              "7.52.1",
              "7.52.0",
              "7.51.0",
              "7.50.3",
              "7.50.2",
              "7.50.1",
              "7.50.0",
              "7.49.1",
              "7.49.0",
              "7.48.0",
              "7.47.1",
              "7.47.0",
              "7.46.0",
              "7.45.0",
              "7.44.0",
              "7.43.0",
              "7.42.1",
              "7.42.0",
              "7.41.0",
              "7.40.0",
              "7.39.0",
              "7.38.0",
              "7.37.1",
              "7.37.0",
              "7.36.0",
              "7.35.0",
              "7.34.0",
              "7.33.0",
              "7.32.0",
              "7.31.0",
              "7.30.0",
              "7.29.0",
              "7.28.1",
              "7.28.0",
              "7.27.0",
              "7.26.0",
              "7.25.0",
              "7.24.0",
              "7.23.1",
              "7.23.0",
              "7.22.0",
              "7.21.7",
              "7.21.6",
              "7.21.5",
              "7.21.4",
              "7.21.3",
              "7.21.2",
              "7.21.1",
              "7.21.0",
              "7.20.1",
              "7.20.0",
              "7.19.7",
              "7.19.6",
              "7.19.5",
              "7.19.4",
              "7.19.3",
              "7.19.2",
              "7.19.1",
              "7.19.0",
              "7.18.2",
              "7.18.1",
              "7.18.0",
              "7.17.1",
              "7.17.0",
              "7.16.4",
              "7.16.3",
              "7.16.2",
              "7.16.1",
              "7.16.0",
              "7.15.5",
              "7.15.4",
              "7.15.3",
              "7.15.2",
              "7.15.1",
              "7.15.0",
              "7.14.1",
              "7.14.0",
              "7.13.2",
              "7.13.1",
              "7.13.0",
              "7.12.3",
              "7.12.2",
              "7.12.1",
              "7.12.0",
              "7.11.2",
              "7.11.1",
              "7.11.0",
              "7.10.8",
              "7.10.7",
              "7.10.6"
            ]
          }
        ],
        "aliases": [
          "CVE-2026-5545"
        ],
        "credits": [
          {
            "name": "Quac Tran and Ngoc Hieu",
            "type": "finder"
          },
          {
            "name": "Stefan Eissing",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Authentication Bypass by Primary Weakness",
            "id": "CWE-305"
          },
          "URL": "https://curl.se/docs/CVE-2026-5545.json",
          "affects": "both",
          "issue": "https://hackerone.com/reports/3642555",
          "last_affected": "8.19.0",
          "package": "curl",
          "severity": "Medium",
          "www": "https://curl.se/docs/CVE-2026-5545.html"
        },
        "details": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1\u0027s and user2\u0027s credentials when it is in fact\nstill using the connection authenticated for user1...",
        "id": "CURL-CVE-2026-5545",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-04-29T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "wrong reuse of HTTP Negotiate connection"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-5545",
    "datePublished": "2026-05-13T08:27:26.065Z",
    "dateReserved": "2026-04-04T12:10:07.125Z",
    "dateUpdated": "2026-09-15T06:02:59.285Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-5545\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-13T17:46:36.115262Z\"}}}], \"references\": [{\"url\": \"https://hackerone.com/reports/3642555\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-13T17:46:02.178Z\"}}], \"cna\": {\"title\": \"wrong reuse of HTTP Negotiate connection\", \"x_osv\": {\"id\": \"CURL-CVE-2026-5545\", \"aliases\": [\"CVE-2026-5545\"], \"credits\": [{\"name\": \"Quac Tran and Ngoc Hieu\", \"type\": \"finder\"}, {\"name\": \"Stefan Eissing\", \"type\": \"remediation developer\"}], \"details\": \"libcurl might in some circumstances reuse the wrong connection when asked to\\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\\nboth use the same host.\\n\\nlibcurl features a pool of recent connections so that subsequent requests can\\nreuse an existing connection to avoid overhead.\\n\\nWhen reusing a connection a range of criteria must be met. Due to a logical\\nerror in the code, a request that was issued by an application could\\nwrongfully reuse an existing connection to the same server that was\\nauthenticated using different credentials.\\n\\nAn application that first uses Negotiate authentication to a server with\\n`user1:password1` and then does another operation to the same server asking\\nfor any authentication method but for `user2:password2` (while the previous\\nconnection is still alive) - the second request gets confused and wrongly\\nreuses the same connection and sends the new request over that connection\\nthinking it uses a mix of user1\u0027s and user2\u0027s credentials when it is in fact\\nstill using the connection authenticated for user1...\", \"summary\": \"wrong reuse of HTTP Negotiate connection\", \"affected\": [{\"ranges\": [{\"type\": \"SEMVER\", \"events\": [{\"introduced\": \"7.10.6\"}, {\"fixed\": \"8.14.2\"}, {\"introduced\": \"8.15.0\"}, {\"fixed\": \"8.16.1\"}, {\"introduced\": \"8.17.0\"}, {\"fixed\": \"8.20.0\"}]}, {\"repo\": \"https://github.com/curl/curl.git\", \"type\": \"GIT\", \"events\": [{\"introduced\": \"e56ae1426cb7a0a4a427cf8d6099a821fdaae428\"}, {\"fixed\": \"33e43985b8f3b9e66691d06e70be0395849856cd\"}]}], \"versions\": [\"8.19.0\", \"8.18.0\", \"8.17.0\", \"8.16.0\", \"8.15.0\", \"8.14.1\", \"8.14.0\", \"8.13.0\", \"8.12.1\", \"8.12.0\", \"8.11.1\", \"8.11.0\", \"8.10.1\", \"8.10.0\", \"8.9.1\", \"8.9.0\", \"8.8.0\", \"8.7.1\", \"8.7.0\", \"8.6.0\", \"8.5.0\", \"8.4.0\", \"8.3.0\", \"8.2.1\", \"8.2.0\", \"8.1.2\", \"8.1.1\", \"8.1.0\", \"8.0.1\", \"8.0.0\", \"7.88.1\", \"7.88.0\", \"7.87.0\", \"7.86.0\", \"7.85.0\", \"7.84.0\", \"7.83.1\", \"7.83.0\", \"7.82.0\", \"7.81.0\", \"7.80.0\", \"7.79.1\", \"7.79.0\", \"7.78.0\", \"7.77.0\", \"7.76.1\", \"7.76.0\", \"7.75.0\", \"7.74.0\", \"7.73.0\", \"7.72.0\", \"7.71.1\", \"7.71.0\", \"7.70.0\", \"7.69.1\", \"7.69.0\", \"7.68.0\", \"7.67.0\", \"7.66.0\", \"7.65.3\", \"7.65.2\", \"7.65.1\", \"7.65.0\", \"7.64.1\", \"7.64.0\", \"7.63.0\", \"7.62.0\", \"7.61.1\", \"7.61.0\", \"7.60.0\", \"7.59.0\", \"7.58.0\", \"7.57.0\", \"7.56.1\", \"7.56.0\", \"7.55.1\", \"7.55.0\", \"7.54.1\", \"7.54.0\", \"7.53.1\", \"7.53.0\", \"7.52.1\", \"7.52.0\", \"7.51.0\", \"7.50.3\", \"7.50.2\", \"7.50.1\", \"7.50.0\", \"7.49.1\", \"7.49.0\", \"7.48.0\", \"7.47.1\", \"7.47.0\", \"7.46.0\", \"7.45.0\", \"7.44.0\", \"7.43.0\", \"7.42.1\", \"7.42.0\", \"7.41.0\", \"7.40.0\", \"7.39.0\", \"7.38.0\", \"7.37.1\", \"7.37.0\", \"7.36.0\", \"7.35.0\", \"7.34.0\", \"7.33.0\", \"7.32.0\", \"7.31.0\", \"7.30.0\", \"7.29.0\", \"7.28.1\", \"7.28.0\", \"7.27.0\", \"7.26.0\", \"7.25.0\", \"7.24.0\", \"7.23.1\", \"7.23.0\", \"7.22.0\", \"7.21.7\", \"7.21.6\", \"7.21.5\", \"7.21.4\", \"7.21.3\", \"7.21.2\", \"7.21.1\", \"7.21.0\", \"7.20.1\", \"7.20.0\", \"7.19.7\", \"7.19.6\", \"7.19.5\", \"7.19.4\", \"7.19.3\", \"7.19.2\", \"7.19.1\", \"7.19.0\", \"7.18.2\", \"7.18.1\", \"7.18.0\", \"7.17.1\", \"7.17.0\", \"7.16.4\", \"7.16.3\", \"7.16.2\", \"7.16.1\", \"7.16.0\", \"7.15.5\", \"7.15.4\", \"7.15.3\", \"7.15.2\", \"7.15.1\", \"7.15.0\", \"7.14.1\", \"7.14.0\", \"7.13.2\", \"7.13.1\", \"7.13.0\", \"7.12.3\", \"7.12.2\", \"7.12.1\", \"7.12.0\", \"7.11.2\", \"7.11.1\", \"7.11.0\", \"7.10.8\", \"7.10.7\", \"7.10.6\"]}], \"modified\": \"2026-09-07T10:34:51.00Z\", \"published\": \"2026-04-29T08:00:00.00Z\", \"schema_version\": \"1.5.0\", \"database_specific\": {\"CWE\": {\"id\": \"CWE-305\", \"desc\": \"Authentication Bypass by Primary Weakness\"}, \"URL\": \"https://curl.se/docs/CVE-2026-5545.json\", \"www\": \"https://curl.se/docs/CVE-2026-5545.html\", \"issue\": \"https://hackerone.com/reports/3642555\", \"affects\": \"both\", \"package\": \"curl\", \"severity\": \"Medium\", \"last_affected\": \"8.19.0\"}}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Quac Tran and Ngoc Hieu\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Stefan Eissing\"}], \"affected\": [{\"vendor\": \"curl\", \"product\": \"curl\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.10.6\", \"lessThan\": \"8.14.2\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.15.0\", \"lessThan\": \"8.16.1\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.17.0\", \"lessThan\": \"8.20.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://github.com/curl/curl.git\", \"vendor\": \"curl\", \"product\": \"curl\", \"versions\": [{\"status\": \"affected\", \"version\": \"e56ae1426cb7a0a4a427cf8d6099a821fdaae428\", \"lessThan\": \"33e43985b8f3b9e66691d06e70be0395849856cd\", \"versionType\": \"git\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"curl\", \"product\": \"curl\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.19.0\"}, {\"status\": \"affected\", \"version\": \"8.18.0\"}, {\"status\": \"affected\", \"version\": \"8.17.0\"}, {\"status\": \"affected\", \"version\": \"8.16.0\"}, {\"status\": \"affected\", \"version\": \"8.15.0\"}, {\"status\": \"affected\", \"version\": \"8.14.1\"}, {\"status\": \"affected\", \"version\": \"8.14.0\"}, {\"status\": \"affected\", \"version\": \"8.13.0\"}, {\"status\": \"affected\", \"version\": \"8.12.1\"}, {\"status\": \"affected\", \"version\": \"8.12.0\"}, {\"status\": \"affected\", \"version\": \"8.11.1\"}, {\"status\": \"affected\", \"version\": \"8.11.0\"}, {\"status\": \"affected\", \"version\": \"8.10.1\"}, {\"status\": \"affected\", \"version\": \"8.10.0\"}, {\"status\": \"affected\", \"version\": \"8.9.1\"}, {\"status\": \"affected\", \"version\": \"8.9.0\"}, {\"status\": \"affected\", \"version\": \"8.8.0\"}, {\"status\": \"affected\", \"version\": \"8.7.1\"}, {\"status\": \"affected\", \"version\": \"8.7.0\"}, {\"status\": \"affected\", \"version\": \"8.6.0\"}, {\"status\": \"affected\", \"version\": \"8.5.0\"}, {\"status\": \"affected\", \"version\": \"8.4.0\"}, {\"status\": \"affected\", \"version\": \"8.3.0\"}, {\"status\": \"affected\", \"version\": \"8.2.1\"}, {\"status\": \"affected\", \"version\": \"8.2.0\"}, {\"status\": \"affected\", \"version\": \"8.1.2\"}, {\"status\": \"affected\", \"version\": \"8.1.1\"}, {\"status\": \"affected\", \"version\": \"8.1.0\"}, {\"status\": \"affected\", \"version\": \"8.0.1\"}, {\"status\": \"affected\", \"version\": \"8.0.0\"}, {\"status\": \"affected\", \"version\": \"7.88.1\"}, {\"status\": \"affected\", \"version\": \"7.88.0\"}, {\"status\": \"affected\", \"version\": \"7.87.0\"}, {\"status\": \"affected\", \"version\": \"7.86.0\"}, {\"status\": \"affected\", \"version\": \"7.85.0\"}, {\"status\": \"affected\", \"version\": \"7.84.0\"}, {\"status\": \"affected\", \"version\": \"7.83.1\"}, {\"status\": \"affected\", \"version\": \"7.83.0\"}, {\"status\": \"affected\", \"version\": \"7.82.0\"}, {\"status\": \"affected\", \"version\": \"7.81.0\"}, {\"status\": \"affected\", \"version\": \"7.80.0\"}, {\"status\": \"affected\", \"version\": \"7.79.1\"}, {\"status\": \"affected\", \"version\": \"7.79.0\"}, {\"status\": \"affected\", \"version\": \"7.78.0\"}, {\"status\": \"affected\", \"version\": \"7.77.0\"}, {\"status\": \"affected\", \"version\": \"7.76.1\"}, {\"status\": \"affected\", \"version\": \"7.76.0\"}, {\"status\": \"affected\", \"version\": \"7.75.0\"}, {\"status\": \"affected\", \"version\": \"7.74.0\"}, {\"status\": \"affected\", \"version\": \"7.73.0\"}, {\"status\": \"affected\", \"version\": \"7.72.0\"}, {\"status\": \"affected\", \"version\": \"7.71.1\"}, {\"status\": \"affected\", \"version\": \"7.71.0\"}, {\"status\": \"affected\", \"version\": \"7.70.0\"}, {\"status\": \"affected\", \"version\": \"7.69.1\"}, {\"status\": \"affected\", \"version\": \"7.69.0\"}, {\"status\": \"affected\", \"version\": \"7.68.0\"}, {\"status\": \"affected\", \"version\": \"7.67.0\"}, {\"status\": \"affected\", \"version\": \"7.66.0\"}, {\"status\": \"affected\", \"version\": \"7.65.3\"}, {\"status\": \"affected\", \"version\": \"7.65.2\"}, {\"status\": \"affected\", \"version\": \"7.65.1\"}, {\"status\": \"affected\", \"version\": \"7.65.0\"}, {\"status\": \"affected\", \"version\": \"7.64.1\"}, {\"status\": \"affected\", \"version\": \"7.64.0\"}, {\"status\": \"affected\", \"version\": \"7.63.0\"}, {\"status\": \"affected\", \"version\": \"7.62.0\"}, {\"status\": \"affected\", \"version\": \"7.61.1\"}, {\"status\": \"affected\", \"version\": \"7.61.0\"}, {\"status\": \"affected\", \"version\": \"7.60.0\"}, {\"status\": \"affected\", \"version\": \"7.59.0\"}, {\"status\": \"affected\", \"version\": \"7.58.0\"}, {\"status\": \"affected\", \"version\": \"7.57.0\"}, {\"status\": \"affected\", \"version\": \"7.56.1\"}, {\"status\": \"affected\", \"version\": \"7.56.0\"}, {\"status\": \"affected\", \"version\": \"7.55.1\"}, {\"status\": \"affected\", \"version\": \"7.55.0\"}, {\"status\": \"affected\", \"version\": \"7.54.1\"}, {\"status\": \"affected\", \"version\": \"7.54.0\"}, {\"status\": \"affected\", \"version\": \"7.53.1\"}, {\"status\": \"affected\", \"version\": \"7.53.0\"}, {\"status\": \"affected\", \"version\": \"7.52.1\"}, {\"status\": \"affected\", \"version\": \"7.52.0\"}, {\"status\": \"affected\", \"version\": \"7.51.0\"}, {\"status\": \"affected\", \"version\": \"7.50.3\"}, {\"status\": \"affected\", \"version\": \"7.50.2\"}, {\"status\": \"affected\", \"version\": \"7.50.1\"}, {\"status\": \"affected\", \"version\": \"7.50.0\"}, {\"status\": \"affected\", \"version\": \"7.49.1\"}, {\"status\": \"affected\", \"version\": \"7.49.0\"}, {\"status\": \"affected\", \"version\": \"7.48.0\"}, {\"status\": \"affected\", \"version\": \"7.47.1\"}, {\"status\": \"affected\", \"version\": \"7.47.0\"}, {\"status\": \"affected\", \"version\": \"7.46.0\"}, {\"status\": \"affected\", \"version\": \"7.45.0\"}, {\"status\": \"affected\", \"version\": \"7.44.0\"}, {\"status\": \"affected\", \"version\": \"7.43.0\"}, {\"status\": \"affected\", \"version\": \"7.42.1\"}, {\"status\": \"affected\", \"version\": \"7.42.0\"}, {\"status\": \"affected\", \"version\": \"7.41.0\"}, {\"status\": \"affected\", \"version\": \"7.40.0\"}, {\"status\": \"affected\", \"version\": \"7.39.0\"}, {\"status\": \"affected\", \"version\": \"7.38.0\"}, {\"status\": \"affected\", \"version\": \"7.37.1\"}, {\"status\": \"affected\", \"version\": \"7.37.0\"}, {\"status\": \"affected\", \"version\": \"7.36.0\"}, {\"status\": \"affected\", \"version\": \"7.35.0\"}, {\"status\": \"affected\", \"version\": \"7.34.0\"}, {\"status\": \"affected\", \"version\": \"7.33.0\"}, {\"status\": \"affected\", \"version\": \"7.32.0\"}, {\"status\": \"affected\", \"version\": \"7.31.0\"}, {\"status\": \"affected\", \"version\": \"7.30.0\"}, {\"status\": \"affected\", \"version\": \"7.29.0\"}, {\"status\": \"affected\", \"version\": \"7.28.1\"}, {\"status\": \"affected\", \"version\": \"7.28.0\"}, {\"status\": \"affected\", \"version\": \"7.27.0\"}, {\"status\": \"affected\", \"version\": \"7.26.0\"}, {\"status\": \"affected\", \"version\": \"7.25.0\"}, {\"status\": \"affected\", \"version\": \"7.24.0\"}, {\"status\": \"affected\", \"version\": \"7.23.1\"}, {\"status\": \"affected\", \"version\": \"7.23.0\"}, {\"status\": \"affected\", \"version\": \"7.22.0\"}, {\"status\": \"affected\", \"version\": \"7.21.7\"}, {\"status\": \"affected\", \"version\": \"7.21.6\"}, {\"status\": \"affected\", \"version\": \"7.21.5\"}, {\"status\": \"affected\", \"version\": \"7.21.4\"}, {\"status\": \"affected\", \"version\": \"7.21.3\"}, {\"status\": \"affected\", \"version\": \"7.21.2\"}, {\"status\": \"affected\", \"version\": \"7.21.1\"}, {\"status\": \"affected\", \"version\": \"7.21.0\"}, {\"status\": \"affected\", \"version\": \"7.20.1\"}, {\"status\": \"affected\", \"version\": \"7.20.0\"}, {\"status\": \"affected\", \"version\": \"7.19.7\"}, {\"status\": \"affected\", \"version\": \"7.19.6\"}, {\"status\": \"affected\", \"version\": \"7.19.5\"}, {\"status\": \"affected\", \"version\": \"7.19.4\"}, {\"status\": \"affected\", \"version\": \"7.19.3\"}, {\"status\": \"affected\", \"version\": \"7.19.2\"}, {\"status\": \"affected\", \"version\": \"7.19.1\"}, {\"status\": \"affected\", \"version\": \"7.19.0\"}, {\"status\": \"affected\", \"version\": \"7.18.2\"}, {\"status\": \"affected\", \"version\": \"7.18.1\"}, {\"status\": \"affected\", \"version\": \"7.18.0\"}, {\"status\": \"affected\", \"version\": \"7.17.1\"}, {\"status\": \"affected\", \"version\": \"7.17.0\"}, {\"status\": \"affected\", \"version\": \"7.16.4\"}, {\"status\": \"affected\", \"version\": \"7.16.3\"}, {\"status\": \"affected\", \"version\": \"7.16.2\"}, {\"status\": \"affected\", \"version\": \"7.16.1\"}, {\"status\": \"affected\", \"version\": \"7.16.0\"}, {\"status\": \"affected\", \"version\": \"7.15.5\"}, {\"status\": \"affected\", \"version\": \"7.15.4\"}, {\"status\": \"affected\", \"version\": \"7.15.3\"}, {\"status\": \"affected\", \"version\": \"7.15.2\"}, {\"status\": \"affected\", \"version\": \"7.15.1\"}, {\"status\": \"affected\", \"version\": \"7.15.0\"}, {\"status\": \"affected\", \"version\": \"7.14.1\"}, {\"status\": \"affected\", \"version\": \"7.14.0\"}, {\"status\": \"affected\", \"version\": \"7.13.2\"}, {\"status\": \"affected\", \"version\": \"7.13.1\"}, {\"status\": \"affected\", \"version\": \"7.13.0\"}, {\"status\": \"affected\", \"version\": \"7.12.3\"}, {\"status\": \"affected\", \"version\": \"7.12.2\"}, {\"status\": \"affected\", \"version\": \"7.12.1\"}, {\"status\": \"affected\", \"version\": \"7.12.0\"}, {\"status\": \"affected\", \"version\": \"7.11.2\"}, {\"status\": \"affected\", \"version\": \"7.11.1\"}, {\"status\": \"affected\", \"version\": \"7.11.0\"}, {\"status\": \"affected\", \"version\": \"7.10.8\"}, {\"status\": \"affected\", \"version\": \"7.10.7\"}, {\"status\": \"affected\", \"version\": \"7.10.6\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://curl.se/docs/CVE-2026-5545.json\"}, {\"url\": \"https://curl.se/docs/CVE-2026-5545.html\"}, {\"url\": \"https://hackerone.com/reports/3642555\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"libcurl might in some circumstances reuse the wrong connection when asked to\\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\\nboth use the same host.\\n\\nlibcurl features a pool of recent connections so that subsequent requests can\\nreuse an existing connection to avoid overhead.\\n\\nWhen reusing a connection a range of criteria must be met. Due to a logical\\nerror in the code, a request that was issued by an application could\\nwrongfully reuse an existing connection to the same server that was\\nauthenticated using different credentials.\\n\\nAn application that first uses Negotiate authentication to a server with\\n`user1:password1` and then does another operation to the same server asking\\nfor any authentication method but for `user2:password2` (while the previous\\nconnection is still alive) - the second request gets confused and wrongly\\nreuses the same connection and sends the new request over that connection\\nthinking it uses a mix of user1\u0027s and user2\u0027s credentials when it is in fact\\nstill using the connection authenticated for user1...\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-305\", \"description\": \"Authentication Bypass by Primary Weakness\"}]}], \"providerMetadata\": {\"orgId\": \"2499f714-1537-4658-8207-48ae4bb9eae9\", \"shortName\": \"curl\", \"dateUpdated\": \"2026-09-15T06:02:59.285Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-5545\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-15T06:02:59.285Z\", \"dateReserved\": \"2026-04-04T12:10:07.125Z\", \"assignerOrgId\": \"2499f714-1537-4658-8207-48ae4bb9eae9\", \"datePublished\": \"2026-05-13T08:27:26.065Z\", \"assignerShortName\": \"curl\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…