Vulnerability Description
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Haxx | Curl | >= 7.46.0, < 8.20.0 |
References
- https://curl.se/docs/CVE-2026-8458.htmlPatchVendor Advisory
- https://curl.se/docs/CVE-2026-8458.jsonVendor Advisory
- https://hackerone.com/reports/3721183ExploitIssue TrackingThird Party Advisory
- https://hackerone.com/reports/3721183ExploitIssue TrackingThird Party Advisory
FAQ
What is CVE-2026-8458?
CVE-2026-8458 is a vulnerability with a CVSS score of 6.5 (MEDIUM). libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'. libcurl features a pool of recent con...
How severe is CVE-2026-8458?
CVE-2026-8458 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-8458?
Check the references section above for vendor advisories and patch information. Affected products include: Haxx Curl.