Skip to content
Heist/ feed
Back to feed
Medium

Negotiate not treated as connection-oriented

Type: advisorySources: OSV

libcurl keeps a pool of its last few connections around after use to facilitate easy, convenient and completely transparent connection reuse for applications. When doing HTTP requests Negotiate authenticated, the entire connection may become authenticated and not only the specific HTTP request which is otherwise how HTTP works, as Negotiate can use NTLM under the hood. curl was not adhering to this fact but would assume that such requests would also be authenticated per request. The net effect is that libcurl may end up reusing an authenticated Negotiate connection and sending subsequent requests on it using new credentials, while the connection remains authenticated with a previous initial credentials setup.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2015-3148
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 09:35 UTC · Revision 1

Source evidence

Negotiate not treated as connection-oriented

core-osv · Original source

Published 22 Apr 2015, 08:00 UTC

libcurl keeps a pool of its last few connections around after use to facilitate easy, convenient and completely transparent connection reuse for applications. When doing HTTP requests Negotiate authenticated, the entire connection may become authenticated and not only the specific HTTP request which is otherwise how HTTP works, as Negotiate can use NTLM under the hood. curl was not adhering to this fact but would assume that such requests would also be authenticated per request. The net effect is that libcurl may end up reusing an authenticated Negotiate connection and sending subsequent requests on it using new credentials, while the connection remains authenticated with a previous initial credentials setup.

osv:CURL-CVE-2015-3148
Complete source record
{
  "id": "28f588bb248646310879f561647e266e566126b39bd112748ca112bf01145622",
  "url": "https://osv.dev/vulnerability/CURL-CVE-2015-3148",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Negotiate not treated as connection-oriented",
    "summary": "libcurl keeps a pool of its last few connections around after use to facilitate easy, convenient and completely transparent connection reuse for applications. When doing HTTP requests Negotiate authenticated, the entire connection may become authenticated and not only the specific HTTP request which is otherwise how HTTP works, as Negotiate can use NTLM under the hood. curl was not adhering to this fact but would assume that such requests would also be authenticated per request. The net effect is that libcurl may end up reusing an authenticated Negotiate connection and sending subsequent requests on it using new credentials, while the connection remains authenticated with a previous initial credentials setup.",
    "evidence": "osv:CURL-CVE-2015-3148",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CURL-CVE-2015-3148",
      "aliases": [
        "CURL-CVE-2015-3148",
        "CVE-2015-3148"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "7.10.6"
                },
                {
                  "fixed": "7.42.0"
                }
              ]
            }
          ],
          "versions": [
            "7.41.0",
            "7.40.0",
            "7.39.0",
            "7.38.0",
            "7.37.1",
            "7.37.0",
            "7.36.0",
            "7.35.0",
            "7.34.0",
            "7.33.0",
            "7.32.0",
            "7.31.0",
            "7.30.0",
            "7.29.0",
            "7.28.1",
            "7.28.0",
            "7.27.0",
            "7.26.0",
            "7.25.0",
            "7.24.0",
            "7.23.1",
            "7.23.0",
            "7.22.0",
            "7.21.7",
            "7.21.6",
            "7.21.5",
            "7.21.4",
            "7.21.3",
            "7.21.2",
            "7.21.1",
            "7.21.0",
            "7.20.1",
            "7.20.0",
            "7.19.7",
            "7.19.6",
            "7.19.5",
            "7.19.4",
            "7.19.3",
            "7.19.2",
            "7.19.1",
            "7.19.0",
            "7.18.2",
            "7.18.1",
            "7.18.0",
            "7.17.1",
            "7.17.0",
            "7.16.4",
            "7.16.3",
            "7.16.2",
            "7.16.1",
            "7.16.0",
            "7.15.5",
            "7.15.4",
            "7.15.3",
            "7.15.2",
            "7.15.1",
            "7.15.0",
            "7.14.1",
            "7.14.0",
            "7.13.2",
            "7.13.1",
            "7.13.0",
            "7.12.3",
            "7.12.2",
            "7.12.1",
            "7.12.0",
            "7.11.2",
            "7.11.1",
            "7.11.0",
            "7.10.8",
            "7.10.7",
            "7.10.6"
          ],
          "database_specific": {
            "source": "https://curl.se/docs/CURL-CVE-2015-3148.json"
          }
        }
      ],
      "modified": "2026-10-24T23:17:46Z",
      "provider": "osv",
      "references": [],
      "provider_metadata": {
        "CWE": {
          "id": "CWE-305",
          "desc": "Authentication Bypass by Primary Weakness"
        },
        "URL": "https://curl.se/docs/CVE-2015-3148.json",
        "www": "https://curl.se/docs/CVE-2015-3148.html",
        "affects": "both",
        "package": "curl",
        "severity": "Medium",
        "last_affected": "7.41.0"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2015-3148",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 444195,
  "published_at": "2015-04-22T08:00:00+00:00"
}