Bug 2511636

Summary: CVE-2026-8458 davix: libcurl: Unauthorized connection reuse due to a logical error [epel-all]
Product: [Fedora] Fedora EPEL Reporter: Rohit Keshri <rkeshri>
Component: davixAssignee: Mihai Patrascoiu <mihai.patrascoiu>
Status: ASSIGNED --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: epel10CC: adev88, mattias.ellert, mihai.patrascoiu
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["ed295d65-c3e4-476d-bd8a-e7718c0564cd"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2496764    

Description Rohit Keshri 2026-08-05 16:35:35 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

libcurl might in some circumstances reuse the wrong connection when asked to
do Negotiate-authenticated ones, even when they are set to use different
'services'.

libcurl features a pool of recent connections so that subsequent requests can
reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical
error in the code, a request that was issued by an application could
wrongfully reuse an existing connection to the same server that was
authenticated using different services.
Comment 1 Mihai Patrascoiu 2026-08-06 07:27:41 UTC 
Hello,

This CVE affects Davix on EPEL8 platform, as over there we bundle libcurl v7.69.0.

Can patch our Davix codebase once upstream patch backport is published for curl v7.69.0.

Cheers,
Mihai