ByteOS Network

Vulnerability Details :

CVE-2026-1965

Assigner-curl

Assigner Org ID-2499f714-1537-4658-8207-48ae4bb9eae9

Published At-11 Mar, 2026 | 10:08

Updated At-11 Mar, 2026 | 14:32

bad reuse of HTTP Negotiate connection

libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API).

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:curl

Assigner Org ID:2499f714-1537-4658-8207-48ae4bb9eae9

Published At:11 Mar, 2026 | 10:08

Updated At:11 Mar, 2026 | 14:32

▼CVE Numbering Authority (CNA)

bad reuse of HTTP Negotiate connection

Affected Products

Vendor

CURL

Product

curl

Default Status

unaffected

Versions

Affected

From 8.18.0 through 8.18.0 (semver)
From 8.17.0 through 8.17.0 (semver)
From 8.16.0 through 8.16.0 (semver)
From 8.15.0 through 8.15.0 (semver)
From 8.14.1 through 8.14.1 (semver)
From 8.14.0 through 8.14.0 (semver)
From 8.13.0 through 8.13.0 (semver)
From 8.12.1 through 8.12.1 (semver)
From 8.12.0 through 8.12.0 (semver)
From 8.11.1 through 8.11.1 (semver)
From 8.11.0 through 8.11.0 (semver)
From 8.10.1 through 8.10.1 (semver)
From 8.10.0 through 8.10.0 (semver)
From 8.9.1 through 8.9.1 (semver)
From 8.9.0 through 8.9.0 (semver)
From 8.8.0 through 8.8.0 (semver)
From 8.7.1 through 8.7.1 (semver)
From 8.7.0 through 8.7.0 (semver)
From 8.6.0 through 8.6.0 (semver)
From 8.5.0 through 8.5.0 (semver)
From 8.4.0 through 8.4.0 (semver)
From 8.3.0 through 8.3.0 (semver)
From 8.2.1 through 8.2.1 (semver)
From 8.2.0 through 8.2.0 (semver)
From 8.1.2 through 8.1.2 (semver)
From 8.1.1 through 8.1.1 (semver)
From 8.1.0 through 8.1.0 (semver)
From 8.0.1 through 8.0.1 (semver)
From 8.0.0 through 8.0.0 (semver)
From 7.88.1 through 7.88.1 (semver)
From 7.88.0 through 7.88.0 (semver)
From 7.87.0 through 7.87.0 (semver)
From 7.86.0 through 7.86.0 (semver)
From 7.85.0 through 7.85.0 (semver)
From 7.84.0 through 7.84.0 (semver)
From 7.83.1 through 7.83.1 (semver)
From 7.83.0 through 7.83.0 (semver)
From 7.82.0 through 7.82.0 (semver)
From 7.81.0 through 7.81.0 (semver)
From 7.80.0 through 7.80.0 (semver)
From 7.79.1 through 7.79.1 (semver)
From 7.79.0 through 7.79.0 (semver)
From 7.78.0 through 7.78.0 (semver)
From 7.77.0 through 7.77.0 (semver)
From 7.76.1 through 7.76.1 (semver)
From 7.76.0 through 7.76.0 (semver)
From 7.75.0 through 7.75.0 (semver)
From 7.74.0 through 7.74.0 (semver)
From 7.73.0 through 7.73.0 (semver)
From 7.72.0 through 7.72.0 (semver)
From 7.71.1 through 7.71.1 (semver)
From 7.71.0 through 7.71.0 (semver)
From 7.70.0 through 7.70.0 (semver)
From 7.69.1 through 7.69.1 (semver)
From 7.69.0 through 7.69.0 (semver)
From 7.68.0 through 7.68.0 (semver)
From 7.67.0 through 7.67.0 (semver)
From 7.66.0 through 7.66.0 (semver)
From 7.65.3 through 7.65.3 (semver)
From 7.65.2 through 7.65.2 (semver)
From 7.65.1 through 7.65.1 (semver)
From 7.65.0 through 7.65.0 (semver)
From 7.64.1 through 7.64.1 (semver)
From 7.64.0 through 7.64.0 (semver)
From 7.63.0 through 7.63.0 (semver)
From 7.62.0 through 7.62.0 (semver)
From 7.61.1 through 7.61.1 (semver)
From 7.61.0 through 7.61.0 (semver)
From 7.60.0 through 7.60.0 (semver)
From 7.59.0 through 7.59.0 (semver)
From 7.58.0 through 7.58.0 (semver)
From 7.57.0 through 7.57.0 (semver)
From 7.56.1 through 7.56.1 (semver)
From 7.56.0 through 7.56.0 (semver)
From 7.55.1 through 7.55.1 (semver)
From 7.55.0 through 7.55.0 (semver)
From 7.54.1 through 7.54.1 (semver)
From 7.54.0 through 7.54.0 (semver)
From 7.53.1 through 7.53.1 (semver)
From 7.53.0 through 7.53.0 (semver)
From 7.52.1 through 7.52.1 (semver)
From 7.52.0 through 7.52.0 (semver)
From 7.51.0 through 7.51.0 (semver)
From 7.50.3 through 7.50.3 (semver)
From 7.50.2 through 7.50.2 (semver)
From 7.50.1 through 7.50.1 (semver)
From 7.50.0 through 7.50.0 (semver)
From 7.49.1 through 7.49.1 (semver)
From 7.49.0 through 7.49.0 (semver)
From 7.48.0 through 7.48.0 (semver)
From 7.47.1 through 7.47.1 (semver)
From 7.47.0 through 7.47.0 (semver)
From 7.46.0 through 7.46.0 (semver)
From 7.45.0 through 7.45.0 (semver)
From 7.44.0 through 7.44.0 (semver)
From 7.43.0 through 7.43.0 (semver)
From 7.42.1 through 7.42.1 (semver)
From 7.42.0 through 7.42.0 (semver)
From 7.41.0 through 7.41.0 (semver)
From 7.40.0 through 7.40.0 (semver)
From 7.39.0 through 7.39.0 (semver)
From 7.38.0 through 7.38.0 (semver)
From 7.37.1 through 7.37.1 (semver)
From 7.37.0 through 7.37.0 (semver)
From 7.36.0 through 7.36.0 (semver)
From 7.35.0 through 7.35.0 (semver)
From 7.34.0 through 7.34.0 (semver)
From 7.33.0 through 7.33.0 (semver)
From 7.32.0 through 7.32.0 (semver)
From 7.31.0 through 7.31.0 (semver)
From 7.30.0 through 7.30.0 (semver)
From 7.29.0 through 7.29.0 (semver)
From 7.28.1 through 7.28.1 (semver)
From 7.28.0 through 7.28.0 (semver)
From 7.27.0 through 7.27.0 (semver)
From 7.26.0 through 7.26.0 (semver)
From 7.25.0 through 7.25.0 (semver)
From 7.24.0 through 7.24.0 (semver)
From 7.23.1 through 7.23.1 (semver)
From 7.23.0 through 7.23.0 (semver)
From 7.22.0 through 7.22.0 (semver)
From 7.21.7 through 7.21.7 (semver)
From 7.21.6 through 7.21.6 (semver)
From 7.21.5 through 7.21.5 (semver)
From 7.21.4 through 7.21.4 (semver)
From 7.21.3 through 7.21.3 (semver)
From 7.21.2 through 7.21.2 (semver)
From 7.21.1 through 7.21.1 (semver)
From 7.21.0 through 7.21.0 (semver)
From 7.20.1 through 7.20.1 (semver)
From 7.20.0 through 7.20.0 (semver)
From 7.19.7 through 7.19.7 (semver)
From 7.19.6 through 7.19.6 (semver)
From 7.19.5 through 7.19.5 (semver)
From 7.19.4 through 7.19.4 (semver)
From 7.19.3 through 7.19.3 (semver)
From 7.19.2 through 7.19.2 (semver)
From 7.19.1 through 7.19.1 (semver)
From 7.19.0 through 7.19.0 (semver)
From 7.18.2 through 7.18.2 (semver)
From 7.18.1 through 7.18.1 (semver)
From 7.18.0 through 7.18.0 (semver)
From 7.17.1 through 7.17.1 (semver)
From 7.17.0 through 7.17.0 (semver)
From 7.16.4 through 7.16.4 (semver)
From 7.16.3 through 7.16.3 (semver)
From 7.16.2 through 7.16.2 (semver)
From 7.16.1 through 7.16.1 (semver)
From 7.16.0 through 7.16.0 (semver)
From 7.15.5 through 7.15.5 (semver)
From 7.15.4 through 7.15.4 (semver)
From 7.15.3 through 7.15.3 (semver)
From 7.15.2 through 7.15.2 (semver)
From 7.15.1 through 7.15.1 (semver)
From 7.15.0 through 7.15.0 (semver)
From 7.14.1 through 7.14.1 (semver)
From 7.14.0 through 7.14.0 (semver)
From 7.13.2 through 7.13.2 (semver)
From 7.13.1 through 7.13.1 (semver)
From 7.13.0 through 7.13.0 (semver)
From 7.12.3 through 7.12.3 (semver)
From 7.12.2 through 7.12.2 (semver)
From 7.12.1 through 7.12.1 (semver)
From 7.12.0 through 7.12.0 (semver)
From 7.11.2 through 7.11.2 (semver)
From 7.11.1 through 7.11.1 (semver)
From 7.11.0 through 7.11.0 (semver)
From 7.10.8 through 7.10.8 (semver)
From 7.10.7 through 7.10.7 (semver)
From 7.10.6 through 7.10.6 (semver)

Problem Types

Type	CWE ID	Description
N/A	N/A	CWE-305 Authentication Bypass by Primary Weakness

Type: N/A

CWE ID: N/A

Description: CWE-305 Authentication Bypass by Primary Weakness

Credits

finder

Zhicheng Chen

remediation developer

Daniel Stenberg

References

Hyperlink	Resource
https://curl.se/docs/CVE-2026-1965.json	N/A
https://curl.se/docs/CVE-2026-1965.html	N/A

Hyperlink: https://curl.se/docs/CVE-2026-1965.json

Resource: N/A

Hyperlink: https://curl.se/docs/CVE-2026-1965.html

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-305	CWE-305 Authentication Bypass by Primary Weakness

Type: CWE

CWE ID: CWE-305

Description: CWE-305 Authentication Bypass by Primary Weakness

Metrics

Version	Base score	Base severity	Vector
3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:2499f714-1537-4658-8207-48ae4bb9eae9

Published At:11 Mar, 2026 | 11:15

Updated At:12 Mar, 2026 | 14:11

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Type: Secondary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CPE Matches

CURL

>>curl>>Versions from 7.10.6(inclusive) to 8.19.0(exclusive)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-305	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-305

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://curl.se/docs/CVE-2026-1965.html	2499f714-1537-4658-8207-48ae4bb9eae9	Patch Vendor Advisory
https://curl.se/docs/CVE-2026-1965.json	2499f714-1537-4658-8207-48ae4bb9eae9	Vendor Advisory

Hyperlink: https://curl.se/docs/CVE-2026-1965.html

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Resource:

Patch

Vendor Advisory

Hyperlink: https://curl.se/docs/CVE-2026-1965.json

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Resource:

Vendor Advisory

Similar CVEs

5Records found

CVE-2023-27536

Matching Score-6

Assigner-HackerOne

View Details

Matching Score-6

Assigner-HackerOne

CVSS Score-5.9||MEDIUM

EPSS-0.01% / 1.35%

7 Day CHG~0.00%

Published-30 Mar, 2023 | 00:00

Updated-14 Feb, 2025 | 16:15

An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.

Vendor-n/a CURL Fedora Project Splunk LLC (Cisco Systems, Inc.)Debian GNU/Linux NetApp, Inc.

Product-h700s h500s ontap debian_linux libcurl h300s h500s_firmware universal_forwarder h300s_firmware h410s_firmware active_iq_unified_manager fedora h700s_firmware h410s https://github.com/curl/curl

CWE ID-CWE-287

Improper Authentication

CWE ID-CWE-305

Authentication Bypass by Primary Weakness

CVE-2026-3784

Matching Score-6

Assigner-curl

View Details

Matching Score-6

Assigner-curl

CVSS Score-6.5||MEDIUM

EPSS-0.02% / 6.35%

7 Day CHG~0.00%

Published-11 Mar, 2026 | 10:09

Updated-12 Mar, 2026 | 14:09

wrong proxy connection reuse with credentials

curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.

Vendor-CURL

Product-curl curl

CWE ID-CWE-305

Authentication Bypass by Primary Weakness

CVE-2023-27535

Matching Score-6

Assigner-HackerOne

View Details

Matching Score-6

Assigner-HackerOne

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 10.88%

7 Day CHG~0.00%

Published-30 Mar, 2023 | 00:00

Updated-09 Jun, 2025 | 15:15

An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.

Vendor-n/a NetApp, Inc.Fedora Project Debian GNU/Linux Splunk LLC (Cisco Systems, Inc.)CURL

Product-debian_linux h700s h300s ontap_9 h410s_firmware universal_forwarder fedora h300s_firmware h700s_firmware h500s h500s_firmware libcurl active_iq_unified_manager h410s https://github.com/curl/curl

CWE ID-CWE-287

Improper Authentication

CWE ID-CWE-305

Authentication Bypass by Primary Weakness

CVE-2023-27538

Matching Score-6

Assigner-HackerOne

View Details

Matching Score-6

Assigner-HackerOne

CVSS Score-7.7||HIGH

EPSS-0.01% / 1.61%

7 Day CHG~0.00%

Published-30 Mar, 2023 | 00:00

Updated-09 Jun, 2025 | 15:15

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.

Vendor-n/a NetApp, Inc.Fedora Project Debian GNU/Linux Broadcom Inc.Splunk LLC (Cisco Systems, Inc.)CURL

Product-debian_linux brocade_fabric_operating_system_firmware h700s h300s h410s_firmware universal_forwarder fedora h300s_firmware h700s_firmware h500s h500s_firmware libcurl clustered_data_ontap active_iq_unified_manager h410s https://github.com/curl/curl

CWE ID-CWE-287

Improper Authentication

CWE ID-CWE-305

Authentication Bypass by Primary Weakness

CVE-2022-40723

Matching Score-4

Assigner-Ping Identity Corporation

View Details

Matching Score-4

Assigner-Ping Identity Corporation

CVSS Score-6.5||MEDIUM

EPSS-0.18% / 39.02%

7 Day CHG~0.00%

Published-25 Apr, 2023 | 00:00

Updated-04 Feb, 2025 | 14:48

Configuration-based MFA Bypass in PingID RADIUS PCV.

The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.

Vendor-Ping Identity Corp.

Product-pingfederate radius_pcv pingid_integration_kit PingID Radius PCV PingID Integration Kit (includes Radius PCV)PingFederate (includes Radius PCV)

CWE ID-CWE-305

Authentication Bypass by Primary Weakness

CWE ID-CWE-287

Improper Authentication

CVE-2026-1965

Credits

bad reuse of HTTP Negotiate connection

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs