CVE-2026-5545: Connection Reuse Vulnerability in libcurl

The core of the vulnerability lies in libcurl's connection pooling mechanism. When a request is made after an authenticated one (specifically using Negotiate authentication), libcurl might incorrectly reuse a connection to the same server that was previously authenticated with different credentials. An attacker could potentially craft a malicious request that leverages this flaw to impersonate a legitimate user or intercept sensitive data. This could manifest as unauthorized access to protected resources, data breaches, or even man-in-the-middle attacks if the connection is reused in a compromised network environment. The impact is amplified in applications that heavily rely on libcurl for secure HTTP(S) communication, especially those handling sensitive information like credentials or financial data.

1. Reserviert2026-04-04
2. Veröffentlicht2026-05-13
3. EPSS aktualisiert2026-05-13

The primary mitigation for CVE-2026-5545 is to upgrade to libcurl version 8.19.1 or later, which contains the fix. If upgrading is not immediately feasible due to compatibility issues or system downtime constraints, consider implementing temporary workarounds. These might include disabling connection reuse within your application's libcurl configuration (though this will impact performance) or implementing stricter authentication checks on the server-side to detect and reject requests using potentially reused connections. Monitor network traffic for suspicious connection patterns. After upgrading, confirm the fix by performing a test request that triggers the vulnerable connection reuse scenario and verifying that a new connection is established.