CVE-2026-1965Patch(haxx / curl)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch haxx curl systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API).

haxx CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://curl.se/docs/CVE-2026-1965.html

Vendor / third-party advisories

https://curl.se/docs/CVE-2026-1965.json

Weakness type (CWE)

CWE-305

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

curl

Threat summary

Patch or workaround signal is available
8 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 5 signals
Technical details provided in 6 signals
Disclosure: 3 classified signals
Peaked 4d ago at 2 mentions (2026-03-12); latest day: 1
8 total mentions across 6 days

Affected systems

Vendors

haxx

Products

curl

Deep dive

Activity timeline8 mentions / 6d

Signal classification2 categories

Patch

562.5%

Disclosure

337.5%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-11	1	Disclosure1
2026-03-12	2	Disclosure1Patch1
2026-03-13	2	Patch2
2026-03-15	1	Disclosure1
2026-03-18	1	Patch1
2026-07-13	1	Patch1

Full discourse8 posts

Open Source Security mailing list@oss_security210d
Patch
4 Low to Medium CVEs fixed in curl https://www.openwall.com/lists/oss-security/2026/03/11/ CVE-2026-1965: bad reuse of HTTP Negotiate connection CVE-2026-3783: token leak with redirect and netrc CVE-2026-3784: wrong proxy connection reuse with credentials CVE-2026-3805: use after free in SMB connection reuse
Post summary
The message announces that four low‑to‑medium severity CVEs have been fixed in curl, highlighting the availability of patches and brief technical details of each issue.
00063792
4.4K followersView on X
草薙沙耶(KUSANAGI)@kusanagi_saya209d
Patch
kusanagi-curl モジュール更新情報 8.19.0-1 KUSANAGI 9 を構成している各モジュールのアップデートを行いました。アップデートにより適用される各モジュールのバージョンは、以下のとおりとなります。 curl 8.19.0-1 この更新には脆弱性(CVE-2026-3805, CVE-2026-3784, CVE-2026-3783, CVE-2026-1965)への対応が含まれます。モジュールのアップデートについては、以下のコマンドで適用可能です。 # ... https://kusanagi.tokyo/releases/23348/
Post summary
The update for kusanagi-curl module 8.19.0-1 includes fixes for CVE-2026-3805, CVE-2026-3784, CVE-2026-3783, and CVE-2026-1965.
01010150
198 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds211d
Disclosure
CVE-2026-1965 Negotiate Authentication Connection Reuse Vulnerability in libcurl https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1965
Post summary
A newly disclosed CVE (CVE‑2026‑1965) describes a Negotiate authentication connection reuse flaw in the libcurl library, but no PoC, exploit, or mitigation details are provided.
0000118
4.0K followersView on X
TECHEPAGES@techepages87d
Patch
9 curl CVEs patched in Debian 13.6 🚨 🔵 CVE-2026-3783/6253 – token & credential leaks on redirects 🔵 CVE-2026-3805/5773 – SMB UAF & wrong reuse 🔵 CVE-2026-1965/5545 – Negotiate auth bypass 🔵 CVE-2026-3784 – proxy auth bypass (CVSS 6.5) 🔵 CVE-2026-6276 – cookie leak 🔵 CVE-2026-4873 – TLS bypass apt upgrade ⬆️
Post summary
Debian 13.6 releases 9 curl CVE patches, detailing each vulnerability and encouraging users to run "apt upgrade" to apply the fixes.
0000064
19 followersView on X
Ferramentas Linux@Cezar_H_Linux204d
Patch
🚨 URGENT: #SUSE & #openSUSE curl update fixes 4 CVEs! 🚨 Includes CVE-2026-1965 (HTTP Negotiate bypass), token leaks (CVE-2026-3783), and a critical SMB use-after-free (CVE-2026-3805). Read more: 👉 https://tinyurl.com/yc3p8esw #Security https://t.co/UrK4inqHTv
Post summary
SUSE/openSUSE curl update fixes four CVEs—including HTTP negotiate bypass, token leaks, and an SMB use‑after‑free—without mentioning any PoC or exploitation activity.
0000046
1.5K followersView on X
CVE@CVEnew207d
Disclosure
CVE-2026-1965 libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent conne… https://www.cve.org/CVERecord?id=CVE-2026-1965
Post summary
The post announces CVE‑2026‑1965, describing a connection‑reuse flaw in libcurl’s Negotiate‑authenticated HTTP/HTTPS handling, with no mention of exploits, patches, or mitigation details.
00000138
56.7K followersView on X
草薙沙耶(KUSANAGI)@kusanagi_saya209d
Patch
kusanagi-curl Module Update 8.19.0-1 KUSANAGI 9 modules have been updated. The updated modules are as follows: curl 8.19.0-1 This update includes support for vulnerability(CVE-2026-3805, CVE-2026-3784, CVE-2026-3783, CVE-2026-1965). The module... https://kusanagi.tokyo/en/releases/23349/
Post summary
A KUSANAGI 9 module update for curl 8.19.0-1 addresses four CVEs, providing a fix or support for these vulnerabilities.
0000045
198 followersView on X
DailyCVE@dailycve210d
Disclosure
🟠 libcurl, Authentication Bypass, #CVE-2026-1965 (Medium) https://dailycve.com/libcurl-authentication-bypass-cve-2026-1965-medium/
Post summary
The post discloses CVE-2026-1965 in libcurl, noting an authentication bypass classified as medium severity, without indicating any PoC, exploit tool, active exploitation, or patch information.
0000020
167 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	haxx	curl	-	-	-

Explore more

Back to dashboard haxx CVEs curl vulnerabilities

What researchers are saying

CVE-2026-1965

TECHEPAGES[verified]@techepagesPatch

Debian 13.6 releases 9 curl CVE patches, detailing each vulnerability and encouraging users to run "apt upgrade" to apply the fixes.

Open Source Security mailing list@oss_securityPatch

The message announces that four low‑to‑medium severity CVEs have been fixed in curl, highlighting the availability of patches and brief technical details of each issue.

草薙沙耶(KUSANAGI)@kusanagi_sayaPatch

The update for kusanagi-curl module 8.19.0-1 includes fixes for CVE-2026-3805, CVE-2026-3784, CVE-2026-3783, and CVE-2026-1965.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A newly disclosed CVE (CVE‑2026‑1965) describes a Negotiate authentication connection reuse flaw in the libcurl library, but no PoC, exploit, or mitigation details are provided.

Ferramentas Linux@Cezar_H_LinuxPatch

SUSE/openSUSE curl update fixes four CVEs—including HTTP negotiate bypass, token leaks, and an SMB use‑after‑free—without mentioning any PoC or exploitation activity.

CVE@CVEnewDisclosure

The post announces CVE‑2026‑1965, describing a connection‑reuse flaw in libcurl’s Negotiate‑authenticated HTTP/HTTPS handling, with no mention of exploits, patches, or mitigation details.

草薙沙耶(KUSANAGI)@kusanagi_sayaPatch

A KUSANAGI 9 module update for curl 8.19.0-1 addresses four CVEs, providing a fix or support for these vulnerabilities.

DailyCVE@dailycveDisclosure

The post discloses CVE-2026-1965 in libcurl, noting an authentication bypass classified as medium severity, without indicating any PoC, exploit tool, active exploitation, or patch information.