CVE-2026-19931

⛔ critical

Summary

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

CVSS Score

9.8

Critical

EPSS Score

1.2

Exploit Probability

Published Date

2026-09-06

First Seen: 2026-09-07

📊 Relative Risk Intelligence

This CVE is Very High Risk - more severe than 90.5% of all 358,566 vulnerabilities in our database.

#34,002

Top 10% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: Sep 8, 2026

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Total

Complete system compromise possible

🏆 Discovered By

Martin Dukek Stefan Eissing (remediation developer)

SSVC data provided by CISA

Last Modified 2026-09-15

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-488

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
haxx	curl	Affected	> 7.64.1 < 8.22.0

🔗 References 3

https://curl.se/docs/CVE-2026-19931.html

Patch Vendor Advisory

https://curl.se/docs/CVE-2026-19931.json

Vendor Advisory

https://hackerone.com/reports/3923520

Exploit Mitigation Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-13608	⚠️ high	7.4	0.6	A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpre...	2026-09-06
CVE-2026-18924	⛔ critical	9.1	0.9	A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with othe...	2026-09-06
CVE-2026-80229	⚠️ high	7.5	0.9	When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy han...	2026-09-06
CVE-2026-80230	⚠️ high	7.5	0.6	When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VER...	2026-09-06
CVE-2026-80231	⚠️ high	7.5	0.9	A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a diffe...	2026-09-06
CVE-2026-80255	⚠️ high	7.5	0.7	A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the ...	2026-09-06

These CVEs affect the same products