Bug 2496764 (CVE-2026-8458)

Summary:	CVE-2026-8458 curl: libcurl: Unauthorized connection reuse due to a logical error
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, bbrownin, Daniel.McGovern, dbosanac, dpaolell, gtanzill, jbuscemi, jdelft, jmitchel, jreimann, jupierce, kshier, lgarciaa, mbiarnes, mdessi, mrizzi, pcattana, ppalepu, ppostler, prdhamdh, rekumar, rhel-process-autobot, sdawley, sghai, sidsharm, stcannon, suppawar, teagle, vlaad, vvoronko, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different service, potentially leading to unauthorized access or information disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2511431, 2511432, 2511433, 2511636
Bug Blocks:

Description OSIDB Bzimport 2026-07-03 07:01:53 UTC

libcurl might in some circumstances reuse the wrong connection when asked to
do Negotiate-authenticated ones, even when they are set to use different
'services'.

libcurl features a pool of recent connections so that subsequent requests can
reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical
error in the code, a request that was issued by an application could
wrongfully reuse an existing connection to the same server that was
authenticated using different services.