# CVE-2026-19931: curl Negotiate authentication connection reuse

Source: https://junglewise.ai/threats/cve-2026-19931-curl-negotiate-authentication-connection-reuse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-19931 · Severity: critical · CVSS 9.8 · Published 2026-09-06

libcurl is a widely-used library for making HTTP requests in applications across many industries. A flaw in Negotiate authentication (used for Windows domain authentication and Kerberos) allows libcurl to incorrectly reuse an authenticated connection between different users, potentially exposing one user's authenticated session to another user's requests. An attacker could exploit this in multi-user or multi-tenant environments to bypass authentication and access another user's data or perform actions as that user.

Technologies: [Haxx Curl](https://junglewise.ai/threats/technologies/curl). Vendors: [Haxx](https://junglewise.ai/threats/vendors/haxx).

## Quick answers

**Is CVE-2026-19931 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19931 being exploited in the wild.

**How severe is CVE-2026-19931?** Critical severity, with a CVSS score of 9.8, published 6 September 2026.

**Which products and versions are affected?** curl curl 7.64.1 through 8.21.0 (multiple ranges; see 8.14.2, 8.16.1, 8.20.1, 8.22.0 as patch boundaries).

**Is there a fix for CVE-2026-19931?** A patch was published on 2026-09-02: curl 8.22.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19931 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-19931?** Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in libcurl's Negotiate authentication connection pooling logic (CWE-488: Exposure of Data Element to Wrong Session). When using Negotiate authentication with empty credentials (treated as ambient user authentication via SSPI on Windows or GSSAPI on other systems), libcurl incorrectly reuses HTTP connections across different authenticated sessions. Because libcurl maintains credentials outside its direct control in ambient authentication scenarios, it cannot detect when the underlying ambient user changes; this allows a subsequent request from a different user to be sent over a previously authenticated connection. The vulnerability affects curl 7.64.1 through 8.21.0, with multiple patch points released. Network-reachable HTTP/HTTPS services using curl or libcurl with Negotiate authentication are vulnerable; exploitation requires only that the attacker can make HTTP requests. Patches are available in curl 8.22.0 and earlier patched versions (8.20.1, 8.16.1, 8.14.2).

## Affected products

- curl curl 7.64.1 through 8.21.0 (multiple ranges; see 8.14.2, 8.16.1, 8.20.1, 8.22.0 as patch boundaries)

## Timeline

- 2026-09-02: disclosed: Public advisory and curl 8.22.0 release
- 2026-09-02: patched: curl 8.22.0 released with fix
- 2026-08-07: other: Issue reported to curl project

## References

- [https://curl.se/docs/CVE-2026-19931.html](https://curl.se/docs/CVE-2026-19931.html)
- [https://curl.se/docs/CVE-2026-19931.json](https://curl.se/docs/CVE-2026-19931.json)

## Related threats

- [curl Public Suffix List domain boundary check bypass in cookie handling](https://junglewise.ai/threats/cve-2026-82209-curl-public-suffix-list-domain-boundary-check-bypass-in-cookie)
- [curl libcurl certificate validation bypass in wolfSSL backend](https://junglewise.ai/threats/cve-2026-82208-curl-libcurl-certificate-validation-bypass-in-wolfssl-backend)
- [curl secure cookie attribute bypass with tab](https://junglewise.ai/threats/cve-2026-80255-curl-secure-cookie-attribute-bypass-with-tab)
- [curl HTTPS connection reuse with mismatched CA store settings](https://junglewise.ai/threats/cve-2026-80231-curl-https-connection-reuse-with-mismatched-ca-store-settings)
- [curl public key pinning bypass with disabled peer verification](https://junglewise.ai/threats/cve-2026-80230-curl-public-key-pinning-bypass-with-disabled-peer-verification)