CURL-CVE-2026-94265

See a problem?
Please try reporting it to the source first.
Source
https://curl.se/docs/CVE-2026-94265.html
Import Source
https://curl.se/docs/CURL-CVE-2026-94265.json
JSON Data
https://api.osv.dev/v1/vulns/CURL-CVE-2026-94265
Aliases
  • CVE-2026-94265
Published
2026-10-14T08:00:00Z
Modified
2026-10-14T19:02:56Z
Summary
Authorization: Negotiate sent to foreign origin
Details

When processing an HTTP redirect to a URL containing userinfo (a username:password component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticket—generated using the ambient identity of the client process to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absence of --location-trusted.

Database specific 
{
    "CWE":  {
        "desc":  "Exposure of Sensitive Information to an Unauthorized Actor",
        "id":  "CWE-200"
    },
    "URL":  "https://curl.se/docs/CVE-2026-94265.json",
    "affects":  "both",
    "issue":  "https://hackerone.com/reports/4040551",
    "last_affected":  "8.22.0",
    "package":  "curl",
    "severity":  "Low",
    "www":  "https://curl.se/docs/CVE-2026-94265.html"
}
Credits
    • Joshua Rogers (Aisle Research) - FINDER
    • Joshua Rogers (Aisle Research) - REMEDIATION_DEVELOPER

Affected packages

Git / github.com/curl/curl.git

Affected ranges

Type
SEMVER
Events
Introduced
8.21.0
Fixed
8.23.0
Type
GIT
Repo
https://github.com/curl/curl.git
Events
Introduced
8f71d0fde515aa4c68002477356c35bd79927729
Fixed
557a52f21e37a626725a9e708c02af129c3ece1b

Affected versions

8.*
8.21.0
8.22.0
Other
curl-8_21_0
curl-8_22_0
rc-8_21_0-1
rc-8_21_0-2
rc-8_21_0-3
rc-8_22_0-1
rc-8_22_0-2
rc-8_22_0-3
rc-8_23_0-1

Database specific

source 
"https://curl.se/docs/CURL-CVE-2026-94265.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "258241408172650082274197032207243121182",
                "202331025740140981690149075963320984142",
                "133154582168718855543557165470914620252",
                "222689747306617021041087690531354622781",
                "331371883817691747955301164846343910716",
                "173680396911909101058002944785969361573",
                "293416567411974312668037515284358805963",
                "33131427712633358860007974826071959084",
                "65856464225235246825689409252828683080",
                "176877547400910687471021854333076347618",
                "63616142820591472155253770476859656451"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-94265-1be73f6f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/557a52f21e37a626725a9e708c02af129c3ece1b",
        "target":  {
            "file":  "lib/http.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "258589147120900445451495645580457467669",
            "length":  3103
        },
        "id":  "CURL-CVE-2026-94265-56eeda09",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/557a52f21e37a626725a9e708c02af129c3ece1b",
        "target":  {
            "file":  "lib/http.c",
            "function":  "output_auth_headers"
        }
    }
]
vanir_signatures_modified 
"2026-10-14T19:02:56Z"