{"id":"CVE-2026-8458","title":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests …","summary":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-488","CWE-305"],"vendor":"haxx","product":"curl","affected":["curl >= 7.46.0, < 8.20.0"],"patched":["curl 8.20.0"],"published":"2026-07-03","updated":"2026-09-15","sourceUpdated":"2026-09-15T07:16:32.327","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8458","references":[{"url":"https://curl.se/docs/CVE-2026-8458.html","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://curl.se/docs/CVE-2026-8458.json","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://hackerone.com/reports/3721183","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://hackerone.com/reports/3721183","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8458.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-8458"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496764"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8458"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8458"},{"url":"https://access.redhat.com/errata/RHSA-2026:29017"},{"url":"https://access.redhat.com/errata/RHSA-2026:34975"},{"url":"https://access.redhat.com/errata/RHSA-2026:56869"},{"url":"https://access.redhat.com/errata/RHSA-2026:69125"},{"url":"https://access.redhat.com/errata/RHSA-2026:69126"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-06T17:31:14.007899Z"},"epss":0.00371,"epssPercentile":0.3091,"scores":{"nvd":6.5,"vendor":8.1},"ingestedAt":"2026-07-04T04:55:39.434Z","slug":"CVE-2026-8458","body":"## Overview\n\nlibcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.\n\n## Affected\n\n- `curl >= 7.46.0, < 8.20.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `curl 8.20.0`\n\n## Vendor advisories\n\n- **RHSA-2026:29017** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:29017)\n- **RHSA-2026:34975** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:34975)\n- **RHSA-2026:56869** · Red Hat · fixed in: Red Hat JBoss Core Services 2.4.62.SP5 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:56869)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces · no fix planned: Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8458.json)\n- **RHSA-2026:69125** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69125)\n- **RHSA-2026:69126** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69126)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":203491,"id":"CVE-2026-8458","ts":1789457645769,"field":"exploit_available","old":"false","new":"true"},{"seq":203490,"id":"CVE-2026-8458","ts":1789457645769,"field":"cvss","old":"8.1","new":"6.5"},{"seq":203489,"id":"CVE-2026-8458","ts":1789457645769,"field":"severity","old":"high","new":"medium"},{"seq":202017,"id":"CVE-2026-8458","ts":1789400044401,"field":"cvss","old":null,"new":"8.1"},{"seq":202016,"id":"CVE-2026-8458","ts":1789400044401,"field":"severity","old":"none","new":"high"},{"seq":200744,"id":"CVE-2026-8458","ts":1789397602853,"field":"cvss","old":"8.1","new":null},{"seq":200743,"id":"CVE-2026-8458","ts":1789397602853,"field":"severity","old":"high","new":"none"},{"seq":199439,"id":"CVE-2026-8458","ts":1789395512492,"field":"cvss","old":null,"new":"8.1"},{"seq":199438,"id":"CVE-2026-8458","ts":1789395512492,"field":"severity","old":"none","new":"high"},{"seq":198684,"id":"CVE-2026-8458","ts":1789392215044,"field":"cvss","old":"8.1","new":null},{"seq":198683,"id":"CVE-2026-8458","ts":1789392215044,"field":"severity","old":"high","new":"none"},{"seq":197017,"id":"CVE-2026-8458","ts":1789384288857,"field":"cvss","old":null,"new":"8.1"},{"seq":197016,"id":"CVE-2026-8458","ts":1789384288857,"field":"severity","old":"none","new":"high"},{"seq":196375,"id":"CVE-2026-8458","ts":1789383756125,"field":"cvss","old":"8.1","new":null},{"seq":196374,"id":"CVE-2026-8458","ts":1789383756125,"field":"severity","old":"high","new":"none"},{"seq":195303,"id":"CVE-2026-8458","ts":1789380568213,"field":"cvss","old":null,"new":"8.1"},{"seq":195302,"id":"CVE-2026-8458","ts":1789380568213,"field":"severity","old":"none","new":"high"},{"seq":194146,"id":"CVE-2026-8458","ts":1789378755076,"field":"cvss","old":"8.1","new":null},{"seq":194145,"id":"CVE-2026-8458","ts":1789378755076,"field":"severity","old":"high","new":"none"},{"seq":192933,"id":"CVE-2026-8458","ts":1789376506429,"field":"cvss","old":null,"new":"8.1"},{"seq":192932,"id":"CVE-2026-8458","ts":1789376506429,"field":"severity","old":"none","new":"high"},{"seq":191720,"id":"CVE-2026-8458","ts":1789373610386,"field":"cvss","old":"8.1","new":null},{"seq":191719,"id":"CVE-2026-8458","ts":1789373610386,"field":"severity","old":"high","new":"none"},{"seq":190505,"id":"CVE-2026-8458","ts":1789369463321,"field":"cvss","old":null,"new":"8.1"},{"seq":190504,"id":"CVE-2026-8458","ts":1789369463321,"field":"severity","old":"none","new":"high"},{"seq":189292,"id":"CVE-2026-8458","ts":1789368389051,"field":"cvss","old":"8.1","new":null},{"seq":189291,"id":"CVE-2026-8458","ts":1789368389051,"field":"severity","old":"high","new":"none"},{"seq":188075,"id":"CVE-2026-8458","ts":1789365226899,"field":"cvss","old":null,"new":"8.1"},{"seq":188074,"id":"CVE-2026-8458","ts":1789365226899,"field":"severity","old":"none","new":"high"},{"seq":186862,"id":"CVE-2026-8458","ts":1789363466316,"field":"cvss","old":"8.1","new":null},{"seq":186861,"id":"CVE-2026-8458","ts":1789363466316,"field":"severity","old":"high","new":"none"},{"seq":185648,"id":"CVE-2026-8458","ts":1789361214591,"field":"cvss","old":null,"new":"8.1"},{"seq":185647,"id":"CVE-2026-8458","ts":1789361214591,"field":"severity","old":"none","new":"high"},{"seq":184435,"id":"CVE-2026-8458","ts":1789358341391,"field":"cvss","old":"8.1","new":null},{"seq":184434,"id":"CVE-2026-8458","ts":1789358341391,"field":"severity","old":"high","new":"none"},{"seq":182686,"id":"CVE-2026-8458","ts":1789354312901,"field":"cvss","old":null,"new":"8.1"},{"seq":182685,"id":"CVE-2026-8458","ts":1789354312901,"field":"severity","old":"none","new":"high"},{"seq":181479,"id":"CVE-2026-8458","ts":1789353311075,"field":"cvss","old":"8.1","new":null},{"seq":181478,"id":"CVE-2026-8458","ts":1789353311075,"field":"severity","old":"high","new":"none"},{"seq":180272,"id":"CVE-2026-8458","ts":1789350275362,"field":"cvss","old":null,"new":"8.1"},{"seq":180271,"id":"CVE-2026-8458","ts":1789350275362,"field":"severity","old":"none","new":"high"},{"seq":179065,"id":"CVE-2026-8458","ts":1789348271997,"field":"cvss","old":"8.1","new":null},{"seq":179064,"id":"CVE-2026-8458","ts":1789348271997,"field":"severity","old":"high","new":"none"},{"seq":177858,"id":"CVE-2026-8458","ts":1789346365021,"field":"cvss","old":null,"new":"8.1"},{"seq":177857,"id":"CVE-2026-8458","ts":1789346365021,"field":"severity","old":"none","new":"high"},{"seq":176651,"id":"CVE-2026-8458","ts":1789343171207,"field":"cvss","old":"8.1","new":null},{"seq":176650,"id":"CVE-2026-8458","ts":1789343171207,"field":"severity","old":"high","new":"none"},{"seq":174768,"id":"CVE-2026-8458","ts":1789334872166,"field":"cvss","old":null,"new":"8.1"},{"seq":174767,"id":"CVE-2026-8458","ts":1789334872166,"field":"severity","old":"none","new":"high"},{"seq":173563,"id":"CVE-2026-8458","ts":1789333684078,"field":"cvss","old":"8.1","new":null}]}