{"id":"CVE-2026-19931","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-19931","summary":"Negotiate ambient user conn reuse","details":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection.","published":"2026-09-02T08:00:00Z","modified":"2026-09-07T14:06:30.305690Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-07T14:06:30.305690Z"}}