CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

CVE details

CVE-2026-19931

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

Score
9.8 critical
Published
2026-09-06
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
ftp/linux-rl9-curllinux-rl9-curl7.76.1_13unaddressedemulation@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>linux-rl9-curl</name>
	<range><lt>8.22.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A flaw in libcurl makes it wrongly reuse an HTTP connection setup for
	a given
hostname using Negotiate authentication, when the initial
	request is done
using empty credentials. This can make user B's
	request get sent over user A's
previously authenticated connection.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-19931</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-19931</url>
    </references>
    <dates>
      <discovery>2026-09-06</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>