Critical severity9.8NVD Advisory· Published Sep 6, 2026· Updated Sep 15, 2026
CVE-2026-19931
CVE-2026-19931
Description
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
3- curl.se/docs/CVE-2026-19931.htmlnvdPatchVendor Advisory
- hackerone.com/reports/3923520nvdExploitMitigationThird Party Advisory
- curl.se/docs/CVE-2026-19931.jsonnvdVendor Advisory
News mentions
1- Patch Tuesday - September 2026Rapid7 Blog · Sep 8, 2026