---
id: CVE-2026-8458
title: |-
  libcurl might in some circumstances reuse the wrong connection when asked to
  do Negotiate-authenticated ones, even when they are set to use different
  "services".

  libcurl features a pool of recent connections so that subsequent requests …
summary: |-
  libcurl might in some circumstances reuse the wrong connection when asked to
  do Negotiate-authenticated ones, even when they are set to use different
  "services".

  libcurl features a pool of recent connections so that subsequent requests …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-488
  - CWE-305
vendor: haxx
product: curl
affected:
  - 'curl >= 7.46.0, < 8.20.0'
patched:
  - curl 8.20.0
published: '2026-07-03'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T07:16:32.327'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8458'
references:
  - url: 'https://curl.se/docs/CVE-2026-8458.html'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://curl.se/docs/CVE-2026-8458.json'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/3721183'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/3721183'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8458.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-8458'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2496764'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-8458'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8458'
  - url: 'https://access.redhat.com/errata/RHSA-2026:29017'
  - url: 'https://access.redhat.com/errata/RHSA-2026:34975'
  - url: 'https://access.redhat.com/errata/RHSA-2026:56869'
  - url: 'https://access.redhat.com/errata/RHSA-2026:69125'
  - url: 'https://access.redhat.com/errata/RHSA-2026:69126'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-06T17:31:14.007899Z'
epss: 0.00371
epssPercentile: 0.31054
scores:
  nvd: 6.5
  vendor: 8.1
ingestedAt: '2026-07-04T04:55:39.434Z'
---

## Overview

libcurl might in some circumstances reuse the wrong connection when asked to
do Negotiate-authenticated ones, even when they are set to use different
"services".

libcurl features a pool of recent connections so that subsequent requests can
reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical
error in the code, a request that was issued by an application could
wrongfully reuse an existing connection to the same server that was
authenticated using different services.

## Affected

- `curl >= 7.46.0, < 8.20.0`

## Remediation

Upgrade past the affected range:

- `curl 8.20.0`

## Vendor advisories

- **RHSA-2026:29017** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:29017)
- **RHSA-2026:34975** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:34975)
- **RHSA-2026:56869** · Red Hat · fixed in: Red Hat JBoss Core Services 2.4.62.SP5 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:56869)
- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces · no fix planned: Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8458.json)
- **RHSA-2026:69125** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69125)
- **RHSA-2026:69126** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69126)