ALPINE-CVE-2026-19931
ALPINE-CVE-2026-19931
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
CVSS 9.8 · Critical · Fix available
- Published
- Updated
Stack: system