CVE-2026-19931

critical · 9.8

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

9.8

CVSS

1.1%

EPSS (exploit prob.)

66th

EPSS percentile

2026-09-06

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-488

Affected products

Vendor	Product	Affected versions
haxx	curl	>= 7.64.1, < 8.22.0

Check a specific version with /api/v1/cve/match.

References

https://curl.se/docs/CVE-2026-19931.html
https://curl.se/docs/CVE-2026-19931.json
https://hackerone.com/reports/3923520
https://hackerone.com/reports/3923520

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-19931