CVE-2026-19931: haxx curl

CVSS 9.8 (critical) · published 2026-09-06

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

Affected products (NVD): haxx curl

Fixed in (NVD): 8.22.0

Weakness: CWE-488

Source: NVD CVE-2026-19931

References

• https://curl.se/docs/CVE-2026-19931.html
• https://curl.se/docs/CVE-2026-19931.json
• https://hackerone.com/reports/3923520
• https://hackerone.com/reports/3923520

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.