ByteOS Network

CVE Vulnerability Details :

CVE-2026-1965

PUBLISHED

More Info Official Page

Assigner-curl

Assigner Org ID-2499f714-1537-4658-8207-48ae4bb9eae9

Published At-11 Mar, 2026 | 10:08

Updated At-11 Mar, 2026 | 14:32

▼CVE Numbering Authority (CNA)

bad reuse of HTTP Negotiate connection

libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API).

Affected Products

Vendor

CURL

Product

curl

Default Status

unaffected

Versions

Affected

From 8.18.0 through 8.18.0 (semver)
From 8.17.0 through 8.17.0 (semver)
From 8.16.0 through 8.16.0 (semver)
From 8.15.0 through 8.15.0 (semver)
From 8.14.1 through 8.14.1 (semver)
From 8.14.0 through 8.14.0 (semver)
From 8.13.0 through 8.13.0 (semver)
From 8.12.1 through 8.12.1 (semver)
From 8.12.0 through 8.12.0 (semver)
From 8.11.1 through 8.11.1 (semver)
From 8.11.0 through 8.11.0 (semver)
From 8.10.1 through 8.10.1 (semver)
From 8.10.0 through 8.10.0 (semver)
From 8.9.1 through 8.9.1 (semver)
From 8.9.0 through 8.9.0 (semver)
From 8.8.0 through 8.8.0 (semver)
From 8.7.1 through 8.7.1 (semver)
From 8.7.0 through 8.7.0 (semver)
From 8.6.0 through 8.6.0 (semver)
From 8.5.0 through 8.5.0 (semver)
From 8.4.0 through 8.4.0 (semver)
From 8.3.0 through 8.3.0 (semver)
From 8.2.1 through 8.2.1 (semver)
From 8.2.0 through 8.2.0 (semver)
From 8.1.2 through 8.1.2 (semver)
From 8.1.1 through 8.1.1 (semver)
From 8.1.0 through 8.1.0 (semver)
From 8.0.1 through 8.0.1 (semver)
From 8.0.0 through 8.0.0 (semver)
From 7.88.1 through 7.88.1 (semver)
From 7.88.0 through 7.88.0 (semver)
From 7.87.0 through 7.87.0 (semver)
From 7.86.0 through 7.86.0 (semver)
From 7.85.0 through 7.85.0 (semver)
From 7.84.0 through 7.84.0 (semver)
From 7.83.1 through 7.83.1 (semver)
From 7.83.0 through 7.83.0 (semver)
From 7.82.0 through 7.82.0 (semver)
From 7.81.0 through 7.81.0 (semver)
From 7.80.0 through 7.80.0 (semver)
From 7.79.1 through 7.79.1 (semver)
From 7.79.0 through 7.79.0 (semver)
From 7.78.0 through 7.78.0 (semver)
From 7.77.0 through 7.77.0 (semver)
From 7.76.1 through 7.76.1 (semver)
From 7.76.0 through 7.76.0 (semver)
From 7.75.0 through 7.75.0 (semver)
From 7.74.0 through 7.74.0 (semver)
From 7.73.0 through 7.73.0 (semver)
From 7.72.0 through 7.72.0 (semver)
From 7.71.1 through 7.71.1 (semver)
From 7.71.0 through 7.71.0 (semver)
From 7.70.0 through 7.70.0 (semver)
From 7.69.1 through 7.69.1 (semver)
From 7.69.0 through 7.69.0 (semver)
From 7.68.0 through 7.68.0 (semver)
From 7.67.0 through 7.67.0 (semver)
From 7.66.0 through 7.66.0 (semver)
From 7.65.3 through 7.65.3 (semver)
From 7.65.2 through 7.65.2 (semver)
From 7.65.1 through 7.65.1 (semver)
From 7.65.0 through 7.65.0 (semver)
From 7.64.1 through 7.64.1 (semver)
From 7.64.0 through 7.64.0 (semver)
From 7.63.0 through 7.63.0 (semver)
From 7.62.0 through 7.62.0 (semver)
From 7.61.1 through 7.61.1 (semver)
From 7.61.0 through 7.61.0 (semver)
From 7.60.0 through 7.60.0 (semver)
From 7.59.0 through 7.59.0 (semver)
From 7.58.0 through 7.58.0 (semver)
From 7.57.0 through 7.57.0 (semver)
From 7.56.1 through 7.56.1 (semver)
From 7.56.0 through 7.56.0 (semver)
From 7.55.1 through 7.55.1 (semver)
From 7.55.0 through 7.55.0 (semver)
From 7.54.1 through 7.54.1 (semver)
From 7.54.0 through 7.54.0 (semver)
From 7.53.1 through 7.53.1 (semver)
From 7.53.0 through 7.53.0 (semver)
From 7.52.1 through 7.52.1 (semver)
From 7.52.0 through 7.52.0 (semver)
From 7.51.0 through 7.51.0 (semver)
From 7.50.3 through 7.50.3 (semver)
From 7.50.2 through 7.50.2 (semver)
From 7.50.1 through 7.50.1 (semver)
From 7.50.0 through 7.50.0 (semver)
From 7.49.1 through 7.49.1 (semver)
From 7.49.0 through 7.49.0 (semver)
From 7.48.0 through 7.48.0 (semver)
From 7.47.1 through 7.47.1 (semver)
From 7.47.0 through 7.47.0 (semver)
From 7.46.0 through 7.46.0 (semver)
From 7.45.0 through 7.45.0 (semver)
From 7.44.0 through 7.44.0 (semver)
From 7.43.0 through 7.43.0 (semver)
From 7.42.1 through 7.42.1 (semver)
From 7.42.0 through 7.42.0 (semver)
From 7.41.0 through 7.41.0 (semver)
From 7.40.0 through 7.40.0 (semver)
From 7.39.0 through 7.39.0 (semver)
From 7.38.0 through 7.38.0 (semver)
From 7.37.1 through 7.37.1 (semver)
From 7.37.0 through 7.37.0 (semver)
From 7.36.0 through 7.36.0 (semver)
From 7.35.0 through 7.35.0 (semver)
From 7.34.0 through 7.34.0 (semver)
From 7.33.0 through 7.33.0 (semver)
From 7.32.0 through 7.32.0 (semver)
From 7.31.0 through 7.31.0 (semver)
From 7.30.0 through 7.30.0 (semver)
From 7.29.0 through 7.29.0 (semver)
From 7.28.1 through 7.28.1 (semver)
From 7.28.0 through 7.28.0 (semver)
From 7.27.0 through 7.27.0 (semver)
From 7.26.0 through 7.26.0 (semver)
From 7.25.0 through 7.25.0 (semver)
From 7.24.0 through 7.24.0 (semver)
From 7.23.1 through 7.23.1 (semver)
From 7.23.0 through 7.23.0 (semver)
From 7.22.0 through 7.22.0 (semver)
From 7.21.7 through 7.21.7 (semver)
From 7.21.6 through 7.21.6 (semver)
From 7.21.5 through 7.21.5 (semver)
From 7.21.4 through 7.21.4 (semver)
From 7.21.3 through 7.21.3 (semver)
From 7.21.2 through 7.21.2 (semver)
From 7.21.1 through 7.21.1 (semver)
From 7.21.0 through 7.21.0 (semver)
From 7.20.1 through 7.20.1 (semver)
From 7.20.0 through 7.20.0 (semver)
From 7.19.7 through 7.19.7 (semver)
From 7.19.6 through 7.19.6 (semver)
From 7.19.5 through 7.19.5 (semver)
From 7.19.4 through 7.19.4 (semver)
From 7.19.3 through 7.19.3 (semver)
From 7.19.2 through 7.19.2 (semver)
From 7.19.1 through 7.19.1 (semver)
From 7.19.0 through 7.19.0 (semver)
From 7.18.2 through 7.18.2 (semver)
From 7.18.1 through 7.18.1 (semver)
From 7.18.0 through 7.18.0 (semver)
From 7.17.1 through 7.17.1 (semver)
From 7.17.0 through 7.17.0 (semver)
From 7.16.4 through 7.16.4 (semver)
From 7.16.3 through 7.16.3 (semver)
From 7.16.2 through 7.16.2 (semver)
From 7.16.1 through 7.16.1 (semver)
From 7.16.0 through 7.16.0 (semver)
From 7.15.5 through 7.15.5 (semver)
From 7.15.4 through 7.15.4 (semver)
From 7.15.3 through 7.15.3 (semver)
From 7.15.2 through 7.15.2 (semver)
From 7.15.1 through 7.15.1 (semver)
From 7.15.0 through 7.15.0 (semver)
From 7.14.1 through 7.14.1 (semver)
From 7.14.0 through 7.14.0 (semver)
From 7.13.2 through 7.13.2 (semver)
From 7.13.1 through 7.13.1 (semver)
From 7.13.0 through 7.13.0 (semver)
From 7.12.3 through 7.12.3 (semver)
From 7.12.2 through 7.12.2 (semver)
From 7.12.1 through 7.12.1 (semver)
From 7.12.0 through 7.12.0 (semver)
From 7.11.2 through 7.11.2 (semver)
From 7.11.1 through 7.11.1 (semver)
From 7.11.0 through 7.11.0 (semver)
From 7.10.8 through 7.10.8 (semver)
From 7.10.7 through 7.10.7 (semver)
From 7.10.6 through 7.10.6 (semver)

Problem Types

Type	CWE ID	Description
N/A	N/A	CWE-305 Authentication Bypass by Primary Weakness

Type: N/A

CWE ID: N/A

Description: CWE-305 Authentication Bypass by Primary Weakness

Credits

finder

Zhicheng Chen

remediation developer

Daniel Stenberg

References

Hyperlink	Resource
https://curl.se/docs/CVE-2026-1965.json	N/A
https://curl.se/docs/CVE-2026-1965.html	N/A

Hyperlink: https://curl.se/docs/CVE-2026-1965.json

Resource: N/A

Hyperlink: https://curl.se/docs/CVE-2026-1965.html

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-305	CWE-305 Authentication Bypass by Primary Weakness

Type: CWE

CWE ID: CWE-305

Description: CWE-305 Authentication Bypass by Primary Weakness

Metrics

Version	Base score	Base severity	Vector
3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References