CVE-2026-19931

criticalpriority · track · 0EPSS 0.007 · 54 %ileDEFRUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.75% (54th) EPSS

CVSS 9.8 · critical

Is it mine?

9 products

Check your exposure

Who says so?

4 sources

cert_bund · nvd · certfr · osv

EPSS · scored 2026-10-22

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-488US

affected products (9)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
IBM AIX 7.3all versionscert_bundDEcpe:/o:ibm:aix:7.3
Microsoft Azure Linux azl3all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Open Source Open Source cURL <8.22.0< 8.22.0cert_bundDE
Open Source cURL< 8.22.0cert_bundDE
haxx curl7.64.1 → 8.22.0nvdUScpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

advisories (5)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3149cURL: Mehrere SchwachstellenDeutsch2026-09-01csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsmechanismen zu umgehen, Informationen offenzulegen und einen Denial-of-Service-Zustand herbeizuführen.
WID-SEC-W-2026-3642Meinberg LANTIME: Mehrere SchwachstellenDeutsch2026-09-29csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Meinberg LANTIME ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren, Denial-of-Service-Zustände herbeizuführen, sowie weitere, nicht näher spezifizierte Angriffe zu starten.
CERTFR-2026-AVI-1336Multiples vulnérabilités dans les produits IBMFrançais2026-10-16vendor · certfrFR
CERTFR-2026-AVI-1351Multiples vulnérabilités dans Oracle MySQLFrançais2026-10-21vendor · certfrFR
CURL-CVE-2026-19931Negotiate ambient user conn reuse2026-09-02vendor · osvUS
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

sources

Which sources assert this record, and when.

cert_bund nvd certfr osv NVD CVE.org MITRE

published 2026-09-06modified 2026-09-15

references (3) nvd

External citations — patches, advisories, analysis.

https://curl.se/docs/CVE-2026-19931.htmlPatchVendor Advisory
https://curl.se/docs/CVE-2026-19931.jsonVendor Advisory
https://hackerone.com/reports/3923520ExploitMitigationThird Party Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan