Vulnerability Details CVE-2026-19931
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given
hostname using Negotiate authentication, when the initial request is done
using empty credentials. This can make user B's request get sent over user A's
previously authenticated connection.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 17.4%
CVSS Severity
CVSS v3 Score 9.8