- 6.5MediumCVSS base score
- 0.41%Exploitation in 30 daysEPSS · top 64% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- YesPublic exploitsa reference or SSVC says so
Description
libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. A reference of the record is tagged as an exploit.
Show the exploits1
References tagged exploit1 reference
Timeline
ID reserved
By curl
- 39 days later
· 39 days later
Published
- 4 months later
· 4 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N |
| NVDNVD · Modified | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.41% · top 64% of all CVEs (11 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.
Affected products
- affected 7.10.6 – < 8.14.2
- affected 8.15.0 – < 8.16.1
- affected 8.17.0 – < 8.20.0
- affected e56ae1426cb7a0a4a427cf8d6099a821fdaae428 – < 33e43985b8f3b9e66691d06e70be0395849856cd
- affected 8.19.0
- affected 8.18.0
- affected 8.17.0
- affected 8.16.0
- affected 8.15.0
- affected 8.14.1
- affected 8.14.0
- affected 8.13.0
- affected 8.12.1
- affected 8.12.0
- affected 8.11.1
- affected 8.11.0
- affected 8.10.1
- affected 8.10.0
- affected 8.9.1
- affected 8.9.0
- affected 8.8.0
- affected 8.7.1
- affected 8.7.0
- affected 8.6.0
- affected 8.5.0
- affected 8.4.0
- affected 8.3.0
- affected 8.2.1
- affected 8.2.0
- affected 8.1.2
- affected 8.1.1
- affected 8.1.0
- affected 8.0.1
- affected 8.0.0
- affected 7.88.1
- affected 7.88.0
- affected 7.87.0
- affected 7.86.0
- affected 7.85.0
- affected 7.84.0
- affected 7.83.1
- affected 7.83.0
- affected 7.82.0
- affected 7.81.0
- and 131 more
References
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-29923 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-5545)Record last updated .