{"id":"CURL-CVE-2015-3148","summary":"Negotiate not treated as connection-oriented","details":"libcurl keeps a pool of its last few connections around after use to\nfacilitate easy, convenient and completely transparent connection reuse for\napplications.\n\nWhen doing HTTP requests Negotiate authenticated, the entire connection may\nbecome authenticated and not only the specific HTTP request which is otherwise\nhow HTTP works, as Negotiate can use NTLM under the hood. curl was not\nadhering to this fact but would assume that such requests would also be\nauthenticated per request.\n\nThe net effect is that libcurl may end up reusing an authenticated Negotiate\nconnection and sending subsequent requests on it using new credentials, while\nthe connection remains authenticated with a previous initial credentials\nsetup.","aliases":["CVE-2015-3148"],"modified":"2026-05-19T09:30:36.706727159Z","published":"2015-04-22T08:00:00Z","database_specific":{"URL":"https://curl.se/docs/CVE-2015-3148.json","last_affected":"7.41.0","package":"curl","www":"https://curl.se/docs/CVE-2015-3148.html","severity":"Medium","CWE":{"desc":"Authentication Bypass by Primary Weakness","id":"CWE-305"},"affects":"both"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"7.10.6"},{"fixed":"7.42.0"}]}],"versions":["7.41.0","7.40.0","7.39.0","7.38.0","7.37.1","7.37.0","7.36.0","7.35.0","7.34.0","7.33.0","7.32.0","7.31.0","7.30.0","7.29.0","7.28.1","7.28.0","7.27.0","7.26.0","7.25.0","7.24.0","7.23.1","7.23.0","7.22.0","7.21.7","7.21.6","7.21.5","7.21.4","7.21.3","7.21.2","7.21.1","7.21.0","7.20.1","7.20.0","7.19.7","7.19.6","7.19.5","7.19.4","7.19.3","7.19.2","7.19.1","7.19.0","7.18.2","7.18.1","7.18.0","7.17.1","7.17.0","7.16.4","7.16.3","7.16.2","7.16.1","7.16.0","7.15.5","7.15.4","7.15.3","7.15.2","7.15.1","7.15.0","7.14.1","7.14.0","7.13.2","7.13.1","7.13.0","7.12.3","7.12.2","7.12.1","7.12.0","7.11.2","7.11.1","7.11.0","7.10.8","7.10.7","7.10.6"],"database_specific":{"source":"https://curl.se/docs/CURL-CVE-2015-3148.json"}}],"schema_version":"1.7.5","credits":[{"name":"Isaac Boukris","type":"FINDER"},{"name":"Daniel Stenberg","type":"REMEDIATION_DEVELOPER"}]}