CVE-2026-8458 Details
Description
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.
A vulnerability exists in curl and libcurl versions 7.43.0 prior to 8.21.0, where the library may incorrectly reuse connections for Negotiate authentication across different service principals. This flaw allows a request to be authenticated with one service principal to inadvertently reuse the same connection for a request to a different service, without performing the necessary authentication handshake or sending a new authorization header. The issue arises from a logical error in how connection reuse is managed, particularly when the same hostname, port, and credentials are used.
Users are advised to upgrade to curl and libcurl version 8.21.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackerone.com/reports/3721183 | CISA-ADP | ExploitIssue TrackingThird Party Advisory |
| https://curl.se/docs/CVE-2026-8458.html | curl | PatchVendor Advisory |
| https://curl.se/docs/CVE-2026-8458.json | curl | Vendor Advisory |
| https://hackerone.com/reports/3721183 | curl | ExploitIssue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-488 | Exposure of Data Element to Wrong Session | curl |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 7.46.0, < 8.20.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | curl |
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 3, 2026 | New CVE Received | curl |