libcurl might in some circumstances reuse the wrong connection when asked to
do Negotiate-authenticated ones, even when they are set to use different
'services'.
libcurl features a pool of recent connections so that subsequent requests can
reuse an existing connection to avoid overhead.
When reusing a connection a range of criteria must be met. Due to a logical
error in the code, a request that was issued by an application could
wrongfully reuse an existing connection to the same server that was
authenticated using different services.
References
| Link | Resource |
|---|---|
| https://curl.se/docs/CVE-2026-8458.html | Patch Vendor Advisory |
| https://curl.se/docs/CVE-2026-8458.json | Vendor Advisory |
| https://hackerone.com/reports/3721183 | Exploit Issue Tracking Third Party Advisory |
| https://hackerone.com/reports/3721183 | Exploit Issue Tracking Third Party Advisory |
Configurations
History
07 Jul 2026, 23:12
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| First Time |
Haxx curl
Haxx |
|
| CPE | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* | |
| References | () https://curl.se/docs/CVE-2026-8458.html - Patch, Vendor Advisory | |
| References | () https://curl.se/docs/CVE-2026-8458.json - Vendor Advisory | |
| References | () https://hackerone.com/reports/3721183 - Exploit, Issue Tracking, Third Party Advisory |
06 Jul 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | () https://hackerone.com/reports/3721183 - |
03 Jul 2026, 07:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-03 07:16
Updated : 2026-07-07 23:12
NVD link : CVE-2026-8458
Mitre link : CVE-2026-8458
CVE.ORG link : CVE-2026-8458
JSON object : View
Products Affected
haxx
- curl
CWE