Bug 2529199 (CVE-2026-19931) - CVE-2026-19931 curl: libcurl: Information disclosure via incorrect connection reuse with Negotiate authentication
Summary: CVE-2026-19931 curl: libcurl: Information disclosure via incorrect connection...
Keywords:
Status: NEW
Alias: CVE-2026-19931
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2535994 2535995 2535990 2535991 2535992 2535993 2535996 2535997 2535998
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-06 17:51 UTC by OSIDB Bzimport
Modified: 2026-09-17 13:12 UTC (History)
41 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-06 17:51:20 UTC 
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given
hostname using Negotiate authentication, when the initial request is done
using empty credentials. This can make user B's request get sent over user A's
previously authenticated connection.
Note You need to log in before you can comment on or make changes to this bug.