CVE-2026-19931

Katalog CVE

CVSS 9.8 · Critical EPSS 0,75%

Kerentanan Exposure of Data Element to Wrong Session pada haxx curl. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

Rincian

Terbit di NVD

6 September 2026

Terakhir diubah

15 September 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-488: Exposure of Data Element to Wrong Session

EPSS (30 hari)

0,75% peluang dieksploitasi; lebih tinggi dari 53,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://curl.se/docs/CVE-2026-19931.html patch · advisory vendor
• https://curl.se/docs/CVE-2026-19931.json advisory vendor
• https://hackerone.com/reports/3923520 exploit · mitigasi · advisory pihak ketiga