libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API).

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0911-1 advisory.

    - CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).
    - CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).
    - CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).
    - CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0921-1 advisory.

    - CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).
    - CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).
    - CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0903-1 advisory.

    - CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).
    - CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).
    - CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).
    - CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is 7.10.6 prior to 8.19.0. It is, therefore, affected by an authentication bypass vulnerability:

  - libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated     HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can     reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must     first be met. Due to a logical error in the code, a request that was issued by an application could     wrongfully reuse an existing connection to the same server that was authenticated using different     credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not 
    *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication     to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to     the same server also using Negotiate but with `user2:password2` (while the previous connection is still     alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate     negotiation is already made, it just sends the request over that connection thinking it uses the user2     credentials when it is in fact still using the connection authenticated for user1... The set of     authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of     connections and thus mitigate this problem, by using one of the following libcurl options to alter how     connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and     `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API). (CVE-2026-1965)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8099-1 advisory.

    Zhicheng Chen discovered that curl could incorrectly reuse the wrong connection for Negotiate-     authenticated HTTP or HTTPS requests. This could result in the use of credentials from a different     connection, contrary to expectations. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-1965)

    It was discovered that curl incorrectly leaked OAuth2 bearer tokens when following a redirect. This could     result in tokens being sent to the wrong host, contrary to expectations. This issue only affected Ubuntu     20.04 LTS. (CVE-2026-3783)

    Muhamad Arga Reksapati discovered that curl incorrectly reused existing HTTP proxy connections even if the     request used different credentials. This could result in the use of incorrect credentials, contrary to     expectations. (CVE-2026-3784)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8084-1 advisory.

    Zhicheng Chen discovered that curl could incorrectly reuse the wrong connection for Negotiate-     authenticated HTTP or HTTPS requests. This could result in the use of credentials from a different     connection, contrary to expectations. (CVE-2026-1965)

    It was discovered that curl incorrectly leaked OAuth2 bearer tokens when following a redirect. This could     result in tokens being sent to the wrong host, contrary to expectations. (CVE-2026-3783)

    Muhamad Arga Reksapati discovered that curl incorrectly reused existing HTTP proxy connections even if the     request used different credentials. This could result in the use of incorrect credentials, contrary to     expectations. (CVE-2026-3784)

    Daniel Wade discovered that curl incorrectly handled certain memory operations when doing a second SMB     request to the same host. An attacker could use this issue to cause curl to crash, resulting in a denial     of service, or possibly execute arbitrary code. This issue only affected Ubuntu 25.10. (CVE-2026-3805)

    Yihang Zhou discovered that curl incorrectly reused .netrc file credentials when following redirects. This     could result in the use of credentials for a different host, contrary to expectations. This issue only     affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-0167)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0885-1 advisory.

    - CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).
    - CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).
    - CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).
    - CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1933737d-1d46-11f1-81da-8447094a420f advisory.

    The curl project reports:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated     HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse     an existing connection to avoid overhead. When reusing a connection a range of criterion must first be     met. Due to a logical error in the code, a request that was issued by an application could wrongfully     reuse an existing connection to the same server that was authenticated using different credentials. One     underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary     to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that     responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also     using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second     request wrongly reused the same connection and since it then sees that the Negotiate negotiation is     already made, it just sends the request over that connection thinking it uses the user2 credentials when     it is in fact still using the connection authenticated for user1... The set of authentication methods to     use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus     mitigate this problem, by using one of the following libcurl options to alter how connections are or are     not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using     the curl_multi API). (CVE-2026-1965)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
303012	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:0911-1)	Nessus	SuSE Local Security Checks	medium
303001	Photon OS 4.0: Curl PHSA-2026-4.0-0977	Nessus	PhotonOS Local Security Checks	medium
302996	SUSE SLES12 Security Update : curl (SUSE-SU-2026:0921-1)	Nessus	SuSE Local Security Checks	medium
302846	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:0903-1)	Nessus	SuSE Local Security Checks	medium
302776	Curl 7.10.6 < 8.19.0 Authentication Bypass	Nessus	Misc.	medium
302762	Ubuntu 18.04 LTS / 20.04 LTS : curl vulnerabilities (USN-8099-1)	Nessus	Ubuntu Local Security Checks	medium
302753	Photon OS 5.0: Curl PHSA-2026-5.0-0785	Nessus	PhotonOS Local Security Checks	medium
302211	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : curl vulnerabilities (USN-8084-1)	Nessus	Ubuntu Local Security Checks	medium
302096	SUSE SLES15 / openSUSE 15 Security Update : curl (SUSE-SU-2026:0885-1)	Nessus	SuSE Local Security Checks	medium
301882	FreeBSD : curl -- Multiple vulnerabilties (1933737d-1d46-11f1-81da-8447094a420f)	Nessus	FreeBSD Local Security Checks	medium
301847	Linux Distros Unpatched Vulnerability : CVE-2026-1965	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-1965

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium