Is CVE-2026-19931 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19931 being exploited in the wild.

How severe is CVE-2026-19931?

Critical severity, with a CVSS score of 9.8, published 6 September 2026.

Which products and versions are affected?

curl curl 7.64.1 through 8.21.0 (multiple ranges; see 8.14.2, 8.16.1, 8.20.1, 8.22.0 as patch boundaries).

Is there a fix for CVE-2026-19931?

A patch was published on 2026-09-02: curl 8.22.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19931 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-19931?

Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19931: curl Negotiate authentication connection reuse

CVE-2026-19931 · Severity: critical · CVSS 9.8 · Published 2026-09-06

libcurl is a widely-used library for making HTTP requests in applications across many industries. A flaw in Negotiate authentication (used for Windows domain authentication and Kerberos) allows libcurl to incorrectly reuse an authenticated connection between different users, potentially exposing one user's authenticated session to another user's requests. An attacker could exploit this in multi-user or multi-tenant environments to bypass authentication and access another user's data or perform actions as that user.

Technologies: Haxx Curl. Vendors: Haxx.

Quick answers

Is CVE-2026-19931 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19931 being exploited in the wild.
How severe is CVE-2026-19931?: Critical severity, with a CVSS score of 9.8, published 6 September 2026.
Which products and versions are affected?: curl curl 7.64.1 through 8.21.0 (multiple ranges; see 8.14.2, 8.16.1, 8.20.1, 8.22.0 as patch boundaries).
Is there a fix for CVE-2026-19931?: A patch was published on 2026-09-02: curl 8.22.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19931 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-19931?: Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in libcurl's Negotiate authentication connection pooling logic (CWE-488: Exposure of Data Element to Wrong Session). When using Negotiate authentication with empty credentials (treated as ambient user authentication via SSPI on Windows or GSSAPI on other systems), libcurl incorrectly reuses HTTP connections across different authenticated sessions. Because libcurl maintains credentials outside its direct control in ambient authentication scenarios, it cannot detect when the underlying ambient user changes; this allows a subsequent request from a different user to be sent over a previously authenticated connection. The vulnerability affects curl 7.64.1 through 8.21.0, with multiple patch points released. Network-reachable HTTP/HTTPS services using curl or libcurl with Negotiate authentication are vulnerable; exploitation requires only that the attacker can make HTTP requests. Patches are available in curl 8.22.0 and earlier patched versions (8.20.1, 8.16.1, 8.14.2).

Affected products

curl curl 7.64.1 through 8.21.0 (multiple ranges; see 8.14.2, 8.16.1, 8.20.1, 8.22.0 as patch boundaries)

Timeline

2026-09-02: disclosed: Public advisory and curl 8.22.0 release
2026-09-02: patched: curl 8.22.0 released with fix
2026-08-07: other: Issue reported to curl project

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.