A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

suse_linux SUSE-SU-2026:5069-1: SUSE SLES15 : Security update for curl (Important) (SUSE-SU-2026:5069-1)

suse_linux SUSE-SU-2026:5068-1: SUSE SLED15 / SLES15 : Security update for curl (Important) (SUSE-SU-2026:5068-1)

oracle CPUOct2026: MySQL Cluster >=9.7.0|<=9.7.4

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.38

oracle CPUOct2026: MySQL Cluster >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.50

oracle CPUOct2026: MySQL Cluster >=26.7.0|<=26.7.2

oracle CPUOct2026: MySQL Server >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Server >=9.7.0|<=9.7.4

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4954-1 advisory.

    - CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
    - CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
    - CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
    - CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
    - CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
    - CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
    - CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
    - CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
    - CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
    - CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
    - CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
    - CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
    - CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
    - CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
    - CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
    - CVE-2026-92389: TFTP direction confusion (bsc#1285015).
    - CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
    - CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
    - CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
    - CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
    - CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-91d799048a advisory.

    - Fix Negotiate ambient user conn reuse (CVE-2026-19931)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-663a2d0ba4 advisory.

    - fix HTTP/2 server push UAF (CVE-2026-18924)
    - fix Negotiate ambient user conn reuse (CVE-2026-19931)
    - remove test1701 - HTTP/2 Upgrade in a HTTP/1.1 POST request is no longer supported

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate
    authentication, when the initial request is done using empty credentials. This can make user B's request
    get sent over user A's previously authenticated connection. (CVE-2026-19931)

The version of curl installed on the remote host is 7.64.1 prior to 8.22.0. It is, therefore, affected by an information disclosure vulnerability:

  - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate     authentication, when the initial request is done using empty credentials. This can make user B's request     get sent over user A's previously authenticated connection. (CVE-2026-19931)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libcurl installed on the remote host is 7.64.1 prior to 8.22.0. It is, therefore, affected by an information disclosure vulnerability:

  - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate     authentication, when the initial request is done using empty credentials. This can make user B's request     get sent over user A's previously authenticated connection. (CVE-2026-19931)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate     authentication, when the initial request is done using empty credentials. This can make user B's request     get sent over user A's previously authenticated connection. (CVE-2026-19931)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
375384	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:4954-1)	Nessus	SuSE Local Security Checks	Local	critical
375119	Photon OS 5.0: Curl PHSA-2026-5.0-92-1008	Nessus	PhotonOS Local Security Checks	Local	critical
375029	Photon OS 4.0: Curl PHSA-2026-4.0-1092	Nessus	PhotonOS Local Security Checks	Local	critical
375018	Photon OS 5.0: Curl PHSA-2026-5.0-90-1049	Nessus	PhotonOS Local Security Checks	Local	critical
375012	Photon OS 5.0: Curl PHSA-2026-5.0-91-1008	Nessus	PhotonOS Local Security Checks	Local	critical
367902	Fedora 44 : curl (2026-91d799048a)	Nessus	Fedora Local Security Checks	Local	critical
362930	Fedora 45 : curl (2026-663a2d0ba4)	Nessus	Fedora Local Security Checks	Local	critical
462118	Echo: curl: security update to 1:8.22.0-1+e1	Tenable Cloud Security	Echo Local Security Checks	Local	critical
462118	Echo: curl: security update to 1:8.22.0-1+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
342616	Curl 7.64.1 < 8.22.0 Negotiate Ambient User Connection Reuse	Nessus	Misc.	Local	medium
342615	libcurl 7.64.1 < 8.22.0 Negotiate Ambient User Connection Reuse	Nessus	Misc.	Local	medium
342437	Linux Distros Unpatched Vulnerability : CVE-2026-19931	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-19931

critical

Tenable Plugins

Coming Soon

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

medium

critical