https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 23:06:16 +0000 https://vulnerability.circl.lu/vuln/cve-2026-5545 <p><strong>Affected:</strong> curl</p> <p>libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host.</p> <p>libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.</p> <p>When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials.</p> <p>An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1&#39;s and user2&#39;s credentials when it is in fact still using the connection authenticated for user1...</p> <p><strong>Affected:</strong> curl</p> <p>libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host.</p> <p>libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.</p> <p>When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials.</p> <p>An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1&#39;s and user2&#39;s credentials when it is in fact still using the connection authenticated for user1...</p> https://vulnerability.circl.lu/vuln/cve-2026-5545