wrong reuse of HTTP Negotiate connection (curl curl)

CVE-2026-5545
MEDIUM 6.5

En bref

Source
NVD
EPSS
EPSS 0.41 % · centile 36 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
curl
Statut NVD
Modified

Description

libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...

Faiblesses (CWE)

  • CWE-305 — Contournement d'authentification par faiblesse primaire
  • CWE-613 — Expiration de session insuffisante

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:NCISA-ADP
CVSS 3.1MEDIUM 6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:NNVD · nvd@nist.gov (Primary)
CVSS 3.1MEDIUM 6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:NNVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
curl · curlaffected 7.10.6 < 8.14.2 ; affected 8.15.0 < 8.16.1 ; affected 8.17.0 < 8.20.0
curl · curlaffected e56ae1426cb7a0a4a427cf8d6099a821fdaae428 < 33e43985b8f3b9e66691d06e70be0395849856cd
curl · curlaffected 8.19.0 ; affected 8.18.0 ; affected 8.17.0 ; affected 8.16.0 ; affected 8.15.0 ; affected 8.14.1

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD