Connection Reuse Vulnerability in libcurl for Negotiate Authentication

CVE-2026-1965

What is CVE-2026-1965?

The libcurl library has a vulnerability that can lead to the incorrect reuse of connections during Negotiate-authenticated HTTP or HTTPS requests. This issue arises when an application authenticates to a server using one set of credentials, then subsequently attempts to connect to the same server with a different set of credentials. Due to a flaw in the connection reuse logic, the initial connection may be reused instead of establishing a new, authenticated session. This can result in sensitive data being sent with the wrong credentials, posing a security risk. Applications can mitigate this problem by adjusting the connection reuse settings in libcurl using specific options.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References