SASL Negotiation Flaw in libcurl Affects LDAP Authentication
CVE-2026-13608

7.4HIGH

Key Information:

Vendor

Curl

Status
Curl
Vendor
CVE Published:
6 September 2026

What is CVE-2026-13608?

A vulnerability exists in the SASL negotiation process of libcurl, where an incomplete handshake during LDAP authentication can mistakenly be treated as valid verification. This flaw could be exploited by attackers conducting Man-in-the-Middle (MITM) attacks, enabling them to inject responses that circumvent proper peer validation, potentially leading to unauthorized access or data manipulation.

Affected Version(s)

curl 7.82.0 < 8.14.2

curl 8.15.0 < 8.16.1

curl 8.17.0 < 8.20.1

References

https://curl.se/docs/CVE-2026-13608.json
https://curl.se/docs/CVE-2026-13608.html
https://hackerone.com/reports/3822248

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eunsoo Kim (Autonomous Code Security team at Microsoft)
Eunsoo Kim
.