CVE-2026-19931

Publication date 6 September 2026

Last updated 25 September 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

9.8 · Critical

Score breakdown

Description

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

Read the notes from the security team

Status

Package Ubuntu Release Status
curl 26.04 LTS resolute
Not affected
24.04 LTS noble
Not affected
22.04 LTS jammy
Not affected
20.04 LTS focal
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected
14.04 LTS trusty
Not affected

Notes

charlescochran

The upstream advisory cites 7103a93 (the middle commit below) as the necessary fix, but in reality, there are three relevant upstream commits (see references above): - 1a17959: adds fn to fix the issue - 7103a93: big refactor which touches that fn - 1c58877: completely removes that fn That third commit explains that the fix has been reverted in favor of documenting the issue here: https://curl.se/libcurl/c/CURLOPT_USERNAME.html. Curl 8.22.0 contains all three of these commits, so it actually ignores the issue entirely and remains vulnerable to it. Thus, Ubuntu releases are considered not-affected due to their equivalence to upstream.

Severity score breakdown

CVSS version: CVSS v3.0

Base score 9.8 · Critical

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Other references

Access our resources on patching vulnerabilities