CVE-2026-8458

Katalog CVE

CVSS 6.5 · Medium EPSS 0,37%

Kerentanan Exposure of Data Element to Wrong Session pada haxx curl. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.

Rincian

Terbit di NVD

3 Juli 2026

Terakhir diubah

15 September 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-488: Exposure of Data Element to Wrong Session

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://curl.se/docs/CVE-2026-8458.html patch · advisory vendor
• https://curl.se/docs/CVE-2026-8458.json advisory vendor
• https://hackerone.com/reports/3721183 exploit · issue tracking · advisory pihak ketiga