CVE-2026-5545

CVE-2026-5545 is a medium-severity vulnerability in Haxx Curl with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-613.

Key facts

Description

libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...

Frequently asked questions

What is CVE-2026-5545?
libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1...
How severe is CVE-2026-5545?
CVE-2026-5545 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability none.
Is CVE-2026-5545 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-5545?
CVE-2026-5545 affects Haxx Curl. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-5545?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-5545 have an EU (EUVD) identifier?
Yes. CVE-2026-5545 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-29923.
When was CVE-2026-5545 published?
CVE-2026-5545 was published on 2026-05-13 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Haxx Curl

All CVEs affecting Haxx Curl →

Other CWE-613 (Insufficient Session Expiration) vulnerabilities

Browse all CWE-613 (Insufficient Session Expiration) vulnerabilities →