CVE-2026-8458 wrong reuse for different services
libcurl may incorrectly reuse authenticated connections for different services, potentially exposing data or bypassing security checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8458?
CVE-2026-8458 is a medium-severity vulnerability in Haxx Curl, published on 3 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services".
libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.
When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.
Weakness: CWE-488
Which versions are affected by CVE-2026-8458?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2026-8458?
Upgrade to a fixed version.
Is CVE-2026-8458 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-8458 exists.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2026-8458, AZL-91809, AZL-91824, BELL-CVE-2026-8458, CLSA-2026-1791344648, CURL-CVE-2026-8458 and 10 more.