Executive brief
libcurl, a widely used library for transferring data over various network protocols, contains a flaw in how it manages reusable network connections. When an application uses Negotiate authentication, libcurl may incorrectly reuse an existing connection intended for a different service. This could lead to data being sent over a connection with the wrong security context, potentially exposing sensitive information to the wrong session.
Technical details
A logical error in libcurl's connection pooling mechanism fails to properly differentiate between Negotiate-authenticated connections when different service names are specified via CURLOPT_SERVICE_NAME or CURLOPT_PROXY_SERVICE_NAME. If a request targets the same host, port, and credentials as an existing pooled connection, libcurl may reuse that connection even if the requested service name differs. This vulnerability is classified as CWE-488 (Exposure of Data Element to Wrong Session). The issue affects libcurl versions 7.43.0 through 8.20.0 and is fixed in version 8.21.0.
Affected products
- curl libcurl 7.43.0 to 8.20.0
Timeline
- 2026-05-08: disclosed: Reported to the curl project
- 2026-06-17: other: Distros notified via openwall
- 2026-06-24: patched: Fixed in libcurl 8.21.0
- 2026-06-24: advisory: Project advisory published