CVE details
CVE-2026-8458
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.
Affected ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| ftp/linux-rl9-curl | linux-rl9-curl | 7.76.1_13 | unaddressed | emulation@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>linux-rl9-curl</name>
<range><lt>8.20.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libcurl might in some circumstances reuse the wrong connection when
asked to
do Negotiate-authenticated ones, even when they are set to
use different
"services".
libcurl features a pool of recent
connections so that subsequent requests can
reuse an existing
connection to avoid overhead.
When reusing a connection a range of
criteria must be met. Due to a logical
error in the code, a request
that was issued by an application could
wrongfully reuse an existing
connection to the same server that was
authenticated using different
services.</p>
</body>
</description>
<references>
<cvename>CVE-2026-8458</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-8458</url>
</references>
<dates>
<discovery>2026-07-03</discovery>
<entry>2026-10-25</entry>
</dates>
</vuln>