{"id":"CURL-CVE-2026-87861","summary":"cross-origin reuse of a Negotiate connection","details":"When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused.","aliases":["CVE-2026-87861"],"modified":"2026-10-14T07:04:24.498358525Z","published":"2026-10-14T08:00:00Z","database_specific":{"www":"https://curl.se/docs/CVE-2026-87861.html","issue":"https://hackerone.com/reports/3972094","CWE":{"id":"CWE-201","desc":"Information Exposure Through Sent Data"},"last_affected":"8.22.0","severity":"Low","package":"curl","affects":"both","URL":"https://curl.se/docs/CVE-2026-87861.json"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"8.21.0"},{"fixed":"8.23.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"bd10924b47c8bf94127eaee8c56e7b5e5418da46"},{"fixed":"7c11f1a1bd53e2cd983fe153e45991302d097647"}]}],"versions":["8.22.0","8.21.0","curl-8_22_0","rc-8_22_0-3","rc-8_22_0-2","rc-8_22_0-1","curl-8_21_0","rc-8_21_0-3"],"database_specific":{"source":"https://curl.se/docs/CURL-CVE-2026-87861.json","vanir_signatures":[{"digest":{"function_hash":"5047354724236835716472614497186324890","length":1290},"id":"CURL-CVE-2026-87861-1624fd0d","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647","target":{"file":"lib/url.c","function":"url_match_auth_nego"},"deprecated":false},{"id":"CURL-CVE-2026-87861-458b9e06","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647","target":{"function":"url_match_conn","file":"lib/url.c"},"deprecated":false,"digest":{"function_hash":"331346910876337639415189483479218654101","length":1396}},{"source":"https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647","target":{"function":"url_match_auth_ntlm","file":"lib/url.c"},"deprecated":false,"digest":{"function_hash":"111765145129924572504308134382021327483","length":1278},"id":"CURL-CVE-2026-87861-87a0672e","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647","target":{"file":"lib/url.c","function":"url_match_http_multiplex"},"deprecated":false,"digest":{"length":559,"function_hash":"95170452790409764848451535469809876786"},"id":"CURL-CVE-2026-87861-ab70e045"},{"signature_version":"v1","source":"https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647","target":{"file":"lib/conncache.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["73717873090900361446590960008152234865","321959195503744687305198217059567444064","190878644918824113703789885286510217732","297021779368288694573578880282766582063","190518343252876468953170277511321584777","38169789549655221556011935478478916988","153220194942279604463217697783985269087","138583814908058441729969860704612136595","254483585621646717040371023297426004673","315723472133804423187504347846054008911","50627081337805088591977180286240700869","288189389200433214441119408497816628096","37685542541009928423447540252806687242","75407180318704451699303769443305508093"]},"id":"CURL-CVE-2026-87861-b1380fd8","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["211734124686578071309853092193671547301","35020423165315942700296557129344567301","39341311509537653183898636263158148142","85333052057399976735265757571708554578","63490270595130877384245234202397076247","20474993308445845108043713850785930821","149589325056044691401797505714153845353","210895461896556705099123093443743673373","228321110504246117981710801171840067225","333199528524459555556860898333861213183","239831514429972538747902203837546500193","259279082343523871736188484653871959150","194014879464599446481595969229673969739","288599401645733170761997458207250170526","126715479736258507034830260040793905370","19382519900709569874111962101131319555","47389140791991525289901733895140098733","150878675832825527333987485805247714751","184490370420304160908092426409745074946","253916515884753246383226737001953821542","328806220436907070502982088381564902968","7185936992958988768548616610824463428","257948625716555535882268008837128912077","133855559600370951446738953583791963816","262629546643542004437619445145432150750","32118216437488211626679966070445683563","73578557574978950293324398379756472048","152338962181371127964721901392465157281","126761494376274708613658528518359624247","119258988697698457769296765622298402469","214803432729363449739980696723517528340","105135349804760838859480469610730392589","100590013990791766571767328498042014502","329549886311032815964217711146638368122","169406568044635825024309813490713515220","66195882138510403574290214966675512232","184490370420304160908092426409745074946","89840168794138373482340297904332830678","243960925490586704285221013394834444799","325492336927904203106411237565334766753","4305275170550834559042012480617383141","102450457697355936298629791911810979738","107676151289117201062468948248341205120","59204103573761727792070038157730185786","132625428051998493013082847368785762648","297487187612993785378863057474402870832","126761494376274708613658528518359624247","119258988697698457769296765622298402469","214803432729363449739980696723517528340","105135349804760838859480469610730392589","100590013990791766571767328498042014502","137828169013185373817964964759892219321","62335702117153566822977405019201908573","262784282587257253250288526160152798031","215624880529885710676086687749150683039","72627347051561301571415661835879123295","22030315953045125824704341734313478856","261896632273134170794080668640453545827","181797689971008400111467831763889995283","287148273964003128537591732557065383143","328284476730432096686836796980997303206","265312975613255352370481983657595254362","294881903181585992448749274256631963374","183346745279187872459266605408593897803","284919182769224328683414802797771558115","331967536340506170322599293668329593985","245308090760396500685386211528402946137","260503666267728553820716521077466920842","262804144264094075445489327267819242682","299799248090689667822961292341608509313","5051517186303706878795885911380313878","12123026085284894829839174745402525042","262726123505561756976686864981986183231","191450466695676944451916728204069049946","51477884958690651105006066165377518763","31732401000149783532587657219119557673"],"threshold":0.9},"id":"CURL-CVE-2026-87861-c417a768","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647","target":{"file":"lib/url.c"}},{"source":"https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647","target":{"file":"lib/conncache.c","function":"Curl_cpool_find"},"deprecated":false,"digest":{"function_hash":"323370832685489076069049882801861262249","length":633},"id":"CURL-CVE-2026-87861-c4e8ccc9","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647","target":{"function":"url_match_result","file":"lib/url.c"},"deprecated":false,"digest":{"function_hash":"99517655648645135732124833188173950523","length":492},"id":"CURL-CVE-2026-87861-e92b4e42"}],"vanir_signatures_modified":"2026-10-14T07:04:24Z"}}],"schema_version":"1.9.0","credits":[{"name":"Axel Mierczuk","type":"FINDER"},{"name":"Stefan Eissing","type":"REMEDIATION_DEVELOPER"}]}