CVE-2026-19931
NONE—CVSS v3
—CVSS v2
0.26%
EPSS (exploit probability)
—CWE
Description
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given
hostname using Negotiate authentication, when the initial request is done
using empty credentials. This can make user B's request get sent over user A's
previously authenticated connection.
Affected routers (0)
No routers currently mapped to this CVE in our database.