# CVE-2026-8458: curl libcurl incorrect connection reuse for Negotiate services

Source: https://junglewise.ai/threats/cve-2026-8458-curl-libcurl-incorrect-connection-reuse-for-negotiate-services  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-8458 · Severity: info · CVSS 0 · Published 2026-07-03

libcurl, a widely used library for transferring data over various network protocols, contains a flaw in how it manages reusable network connections. When an application uses Negotiate authentication, libcurl may incorrectly reuse an existing connection intended for a different service. This could lead to data being sent over a connection with the wrong security context, potentially exposing sensitive information to the wrong session.

## Quick answers

**Is CVE-2026-8458 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8458 being exploited in the wild.

**How severe is CVE-2026-8458?** Informational severity, with a CVSS score of 0, published 3 July 2026.

**Which products and versions are affected?** curl libcurl 7.43.0 to 8.20.0.

**Is there a fix for CVE-2026-8458?** A patch was published on 2026-06-24: Fixed in libcurl 8.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8458 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8458?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A logical error in libcurl's connection pooling mechanism fails to properly differentiate between Negotiate-authenticated connections when different service names are specified via CURLOPT_SERVICE_NAME or CURLOPT_PROXY_SERVICE_NAME. If a request targets the same host, port, and credentials as an existing pooled connection, libcurl may reuse that connection even if the requested service name differs. This vulnerability is classified as CWE-488 (Exposure of Data Element to Wrong Session). The issue affects libcurl versions 7.43.0 through 8.20.0 and is fixed in version 8.21.0.

## Affected products

- curl libcurl 7.43.0 to 8.20.0

## Timeline

- 2026-05-08: disclosed: Reported to the curl project
- 2026-06-17: other: Distros notified via openwall
- 2026-06-24: patched: Fixed in libcurl 8.21.0
- 2026-06-24: advisory: Project advisory published

## References

- [https://curl.se/docs/CVE-2026-8458.html](https://curl.se/docs/CVE-2026-8458.html)
- [https://curl.se/docs/CVE-2026-8458.json](https://curl.se/docs/CVE-2026-8458.json)
- [https://hackerone.com/reports/3721183](https://hackerone.com/reports/3721183)