Connection Reuse Vulnerability in libcurl for Negotiate Authentication

CVE-2026-1965

What is CVE-2026-1965?

The libcurl library has a vulnerability that can lead to the incorrect reuse of connections during Negotiate-authenticated HTTP or HTTPS requests. This issue arises when an application authenticates to a server using one set of credentials, then subsequently attempts to connect to the same server with a different set of credentials. Due to a flaw in the connection reuse logic, the initial connection may be reused instead of establishing a new, authenticated session. This can result in sensitive data being sent with the wrong credentials, posing a security risk. Applications can mitigate this problem by adjusting the connection reuse settings in libcurl using specific options.

References