CVE-2026-8458

published 2026-07-03

CVE-2026-8458: libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different…

Priority P3 39 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C N I H A N

libcurl might in some circumstances reuse the wrong connection when asked to
do Negotiate-authenticated ones, even when they are set to use different
'services'.

libcurl features a pool of recent connections so that subsequent requests can
reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical
error in the code, a request that was issued by an application could
wrongfully reuse an existing connection to the same server that was
authenticated using different services.

Affected

100 ranges · showing 25

Vendor	Product	Version range	Fixed in
curl	curl	7.43.0 – 7.43.0	—
curl	curl	7.44.0 – 7.44.0	—
curl	curl	7.45.0 – 7.45.0	—
curl	curl	7.46.0 – 7.46.0	—
curl	curl	7.47.0 – 7.47.0	—
curl	curl	7.47.1 – 7.47.1	—
curl	curl	7.48.0 – 7.48.0	—
curl	curl	7.49.0 – 7.49.0	—
curl	curl	7.49.1 – 7.49.1	—
curl	curl	7.50.0 – 7.50.0	—
curl	curl	7.50.1 – 7.50.1	—
curl	curl	7.50.2 – 7.50.2	—
curl	curl	7.50.3 – 7.50.3	—
curl	curl	7.51.0 – 7.51.0	—
curl	curl	7.52.0 – 7.52.0	—
curl	curl	7.52.1 – 7.52.1	—
curl	curl	7.53.0 – 7.53.0	—
curl	curl	7.53.1 – 7.53.1	—
curl	curl	7.54.0 – 7.54.0	—
curl	curl	7.54.1 – 7.54.1	—
curl	curl	7.55.0 – 7.55.0	—
curl	curl	7.55.1 – 7.55.1	—
curl	curl	7.56.0 – 7.56.0	—
curl	curl	7.56.1 – 7.56.1	—
curl	curl	7.57.0 – 7.57.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.