CURL-CVE-2026-87861

See a problem?
Please try reporting it to the source first.
Source
https://curl.se/docs/CVE-2026-87861.html
Import Source
https://curl.se/docs/CURL-CVE-2026-87861.json
JSON Data
https://api.osv.dev/v1/vulns/CURL-CVE-2026-87861
Aliases
  • CVE-2026-87861
Published
2026-10-14T08:00:00Z
Modified
2026-10-14T07:04:24Z
Summary
cross-origin reuse of a Negotiate connection
Details

When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.

Database specific 
{
    "CWE":  {
        "desc":  "Information Exposure Through Sent Data",
        "id":  "CWE-201"
    },
    "URL":  "https://curl.se/docs/CVE-2026-87861.json",
    "affects":  "both",
    "issue":  "https://hackerone.com/reports/3972094",
    "last_affected":  "8.22.0",
    "package":  "curl",
    "severity":  "Low",
    "www":  "https://curl.se/docs/CVE-2026-87861.html"
}
Credits
    • Axel Mierczuk - FINDER
    • Stefan Eissing - REMEDIATION_DEVELOPER

Affected packages

Git / github.com/curl/curl.git

Affected ranges

Type
SEMVER
Events
Introduced
8.21.0
Fixed
8.23.0
Type
GIT
Repo
https://github.com/curl/curl.git
Events
Introduced
bd10924b47c8bf94127eaee8c56e7b5e5418da46
Fixed
7c11f1a1bd53e2cd983fe153e45991302d097647

Affected versions

8.*
8.21.0
8.22.0
Other
curl-8_21_0
curl-8_22_0
rc-8_21_0-3
rc-8_22_0-1
rc-8_22_0-2
rc-8_22_0-3

Database specific

source 
"https://curl.se/docs/CURL-CVE-2026-87861.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "5047354724236835716472614497186324890",
            "length":  1290
        },
        "id":  "CURL-CVE-2026-87861-1624fd0d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647",
        "target":  {
            "file":  "lib/url.c",
            "function":  "url_match_auth_nego"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "331346910876337639415189483479218654101",
            "length":  1396
        },
        "id":  "CURL-CVE-2026-87861-458b9e06",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647",
        "target":  {
            "file":  "lib/url.c",
            "function":  "url_match_conn"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "111765145129924572504308134382021327483",
            "length":  1278
        },
        "id":  "CURL-CVE-2026-87861-87a0672e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647",
        "target":  {
            "file":  "lib/url.c",
            "function":  "url_match_auth_ntlm"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "95170452790409764848451535469809876786",
            "length":  559
        },
        "id":  "CURL-CVE-2026-87861-ab70e045",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647",
        "target":  {
            "file":  "lib/url.c",
            "function":  "url_match_http_multiplex"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "73717873090900361446590960008152234865",
                "321959195503744687305198217059567444064",
                "190878644918824113703789885286510217732",
                "297021779368288694573578880282766582063",
                "190518343252876468953170277511321584777",
                "38169789549655221556011935478478916988",
                "153220194942279604463217697783985269087",
                "138583814908058441729969860704612136595",
                "254483585621646717040371023297426004673",
                "315723472133804423187504347846054008911",
                "50627081337805088591977180286240700869",
                "288189389200433214441119408497816628096",
                "37685542541009928423447540252806687242",
                "75407180318704451699303769443305508093"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-87861-b1380fd8",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647",
        "target":  {
            "file":  "lib/conncache.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "211734124686578071309853092193671547301",
                "35020423165315942700296557129344567301",
                "39341311509537653183898636263158148142",
                "85333052057399976735265757571708554578",
                "63490270595130877384245234202397076247",
                "20474993308445845108043713850785930821",
                "149589325056044691401797505714153845353",
                "210895461896556705099123093443743673373",
                "228321110504246117981710801171840067225",
                "333199528524459555556860898333861213183",
                "239831514429972538747902203837546500193",
                "259279082343523871736188484653871959150",
                "194014879464599446481595969229673969739",
                "288599401645733170761997458207250170526",
                "126715479736258507034830260040793905370",
                "19382519900709569874111962101131319555",
                "47389140791991525289901733895140098733",
                "150878675832825527333987485805247714751",
                "184490370420304160908092426409745074946",
                "253916515884753246383226737001953821542",
                "328806220436907070502982088381564902968",
                "7185936992958988768548616610824463428",
                "257948625716555535882268008837128912077",
                "133855559600370951446738953583791963816",
                "262629546643542004437619445145432150750",
                "32118216437488211626679966070445683563",
                "73578557574978950293324398379756472048",
                "152338962181371127964721901392465157281",
                "126761494376274708613658528518359624247",
                "119258988697698457769296765622298402469",
                "214803432729363449739980696723517528340",
                "105135349804760838859480469610730392589",
                "100590013990791766571767328498042014502",
                "329549886311032815964217711146638368122",
                "169406568044635825024309813490713515220",
                "66195882138510403574290214966675512232",
                "184490370420304160908092426409745074946",
                "89840168794138373482340297904332830678",
                "243960925490586704285221013394834444799",
                "325492336927904203106411237565334766753",
                "4305275170550834559042012480617383141",
                "102450457697355936298629791911810979738",
                "107676151289117201062468948248341205120",
                "59204103573761727792070038157730185786",
                "132625428051998493013082847368785762648",
                "297487187612993785378863057474402870832",
                "126761494376274708613658528518359624247",
                "119258988697698457769296765622298402469",
                "214803432729363449739980696723517528340",
                "105135349804760838859480469610730392589",
                "100590013990791766571767328498042014502",
                "137828169013185373817964964759892219321",
                "62335702117153566822977405019201908573",
                "262784282587257253250288526160152798031",
                "215624880529885710676086687749150683039",
                "72627347051561301571415661835879123295",
                "22030315953045125824704341734313478856",
                "261896632273134170794080668640453545827",
                "181797689971008400111467831763889995283",
                "287148273964003128537591732557065383143",
                "328284476730432096686836796980997303206",
                "265312975613255352370481983657595254362",
                "294881903181585992448749274256631963374",
                "183346745279187872459266605408593897803",
                "284919182769224328683414802797771558115",
                "331967536340506170322599293668329593985",
                "245308090760396500685386211528402946137",
                "260503666267728553820716521077466920842",
                "262804144264094075445489327267819242682",
                "299799248090689667822961292341608509313",
                "5051517186303706878795885911380313878",
                "12123026085284894829839174745402525042",
                "262726123505561756976686864981986183231",
                "191450466695676944451916728204069049946",
                "51477884958690651105006066165377518763",
                "31732401000149783532587657219119557673"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-87861-c417a768",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647",
        "target":  {
            "file":  "lib/url.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "323370832685489076069049882801861262249",
            "length":  633
        },
        "id":  "CURL-CVE-2026-87861-c4e8ccc9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647",
        "target":  {
            "file":  "lib/conncache.c",
            "function":  "Curl_cpool_find"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "99517655648645135732124833188173950523",
            "length":  492
        },
        "id":  "CURL-CVE-2026-87861-e92b4e42",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647",
        "target":  {
            "file":  "lib/url.c",
            "function":  "url_match_result"
        }
    }
]
vanir_signatures_modified 
"2026-10-14T07:04:24Z"