Low
cross-origin reuse of a Negotiate connection
Type: advisorySources: OSV
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-87861
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:38 UTC · Revision 1
Source evidence
cross-origin reuse of a Negotiate connection
core-osv · Original sourcePublished 14 Oct 2026, 08:00 UTC
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.
osv:CURL-CVE-2026-87861
Complete source record
{
"id": "189dd8c19749e42f937b30bcf245311ac63aca806823c1076da31bc7f05a08ff",
"url": "https://osv.dev/vulnerability/CURL-CVE-2026-87861",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "cross-origin reuse of a Negotiate connection",
"summary": "When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.",
"evidence": "osv:CURL-CVE-2026-87861",
"products": [],
"severity": "low",
"structured": {
"id": "CURL-CVE-2026-87861",
"aliases": [
"CURL-CVE-2026-87861",
"CVE-2026-87861"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "8.21.0"
},
{
"fixed": "8.23.0"
}
]
},
{
"repo": "https://github.com/curl/curl.git",
"type": "GIT",
"events": [
{
"introduced": "bd10924b47c8bf94127eaee8c56e7b5e5418da46"
},
{
"fixed": "7c11f1a1bd53e2cd983fe153e45991302d097647"
}
]
}
],
"versions": [
"8.22.0",
"8.21.0",
"curl-8_22_0",
"rc-8_22_0-3",
"rc-8_22_0-2",
"rc-8_22_0-1",
"curl-8_21_0",
"rc-8_21_0-3"
],
"database_specific": {
"source": "https://curl.se/docs/CURL-CVE-2026-87861.json",
"vanir_signatures": [
{
"id": "CURL-CVE-2026-87861-1624fd0d",
"digest": {
"length": 1290,
"function_hash": "5047354724236835716472614497186324890"
},
"source": "https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647",
"target": {
"file": "lib/url.c",
"function": "url_match_auth_nego"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-87861-458b9e06",
"digest": {
"length": 1396,
"function_hash": "331346910876337639415189483479218654101"
},
"source": "https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647",
"target": {
"file": "lib/url.c",
"function": "url_match_conn"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-87861-87a0672e",
"digest": {
"length": 1278,
"function_hash": "111765145129924572504308134382021327483"
},
"source": "https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647",
"target": {
"file": "lib/url.c",
"function": "url_match_auth_ntlm"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-87861-ab70e045",
"digest": {
"length": 559,
"function_hash": "95170452790409764848451535469809876786"
},
"source": "https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647",
"target": {
"file": "lib/url.c",
"function": "url_match_http_multiplex"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-87861-b1380fd8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"73717873090900361446590960008152234865",
"321959195503744687305198217059567444064",
"190878644918824113703789885286510217732",
"297021779368288694573578880282766582063",
"190518343252876468953170277511321584777",
"38169789549655221556011935478478916988",
"153220194942279604463217697783985269087",
"138583814908058441729969860704612136595",
"254483585621646717040371023297426004673",
"315723472133804423187504347846054008911",
"50627081337805088591977180286240700869",
"288189389200433214441119408497816628096",
"37685542541009928423447540252806687242",
"75407180318704451699303769443305508093"
]
},
"source": "https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647",
"target": {
"file": "lib/conncache.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-87861-c417a768",
"digest": {
"threshold": 0.9,
"line_hashes": [
"211734124686578071309853092193671547301",
"35020423165315942700296557129344567301",
"39341311509537653183898636263158148142",
"85333052057399976735265757571708554578",
"63490270595130877384245234202397076247",
"20474993308445845108043713850785930821",
"149589325056044691401797505714153845353",
"210895461896556705099123093443743673373",
"228321110504246117981710801171840067225",
"333199528524459555556860898333861213183",
"239831514429972538747902203837546500193",
"259279082343523871736188484653871959150",
"194014879464599446481595969229673969739",
"288599401645733170761997458207250170526",
"126715479736258507034830260040793905370",
"19382519900709569874111962101131319555",
"47389140791991525289901733895140098733",
"150878675832825527333987485805247714751",
"184490370420304160908092426409745074946",
"253916515884753246383226737001953821542",
"328806220436907070502982088381564902968",
"7185936992958988768548616610824463428",
"257948625716555535882268008837128912077",
"133855559600370951446738953583791963816",
"262629546643542004437619445145432150750",
"32118216437488211626679966070445683563",
"73578557574978950293324398379756472048",
"152338962181371127964721901392465157281",
"126761494376274708613658528518359624247",
"119258988697698457769296765622298402469",
"214803432729363449739980696723517528340",
"105135349804760838859480469610730392589",
"100590013990791766571767328498042014502",
"329549886311032815964217711146638368122",
"169406568044635825024309813490713515220",
"66195882138510403574290214966675512232",
"184490370420304160908092426409745074946",
"89840168794138373482340297904332830678",
"243960925490586704285221013394834444799",
"325492336927904203106411237565334766753",
"4305275170550834559042012480617383141",
"102450457697355936298629791911810979738",
"107676151289117201062468948248341205120",
"59204103573761727792070038157730185786",
"132625428051998493013082847368785762648",
"297487187612993785378863057474402870832",
"126761494376274708613658528518359624247",
"119258988697698457769296765622298402469",
"214803432729363449739980696723517528340",
"105135349804760838859480469610730392589",
"100590013990791766571767328498042014502",
"137828169013185373817964964759892219321",
"62335702117153566822977405019201908573",
"262784282587257253250288526160152798031",
"215624880529885710676086687749150683039",
"72627347051561301571415661835879123295",
"22030315953045125824704341734313478856",
"261896632273134170794080668640453545827",
"181797689971008400111467831763889995283",
"287148273964003128537591732557065383143",
"328284476730432096686836796980997303206",
"265312975613255352370481983657595254362",
"294881903181585992448749274256631963374",
"183346745279187872459266605408593897803",
"284919182769224328683414802797771558115",
"331967536340506170322599293668329593985",
"245308090760396500685386211528402946137",
"260503666267728553820716521077466920842",
"262804144264094075445489327267819242682",
"299799248090689667822961292341608509313",
"5051517186303706878795885911380313878",
"12123026085284894829839174745402525042",
"262726123505561756976686864981986183231",
"191450466695676944451916728204069049946",
"51477884958690651105006066165377518763",
"31732401000149783532587657219119557673"
]
},
"source": "https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647",
"target": {
"file": "lib/url.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-87861-c4e8ccc9",
"digest": {
"length": 633,
"function_hash": "323370832685489076069049882801861262249"
},
"source": "https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647",
"target": {
"file": "lib/conncache.c",
"function": "Curl_cpool_find"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-87861-e92b4e42",
"digest": {
"length": 492,
"function_hash": "99517655648645135732124833188173950523"
},
"source": "https://github.com/curl/curl.git/commit/7c11f1a1bd53e2cd983fe153e45991302d097647",
"target": {
"file": "lib/url.c",
"function": "url_match_result"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-25T01:05:14Z"
}
}
],
"modified": "2026-10-25T01:05:14.174491990Z",
"provider": "osv",
"references": [],
"provider_metadata": {
"CWE": {
"id": "CWE-201",
"desc": "Information Exposure Through Sent Data"
},
"URL": "https://curl.se/docs/CVE-2026-87861.json",
"www": "https://curl.se/docs/CVE-2026-87861.html",
"issue": "https://hackerone.com/reports/3972094",
"affects": "both",
"package": "curl",
"severity": "Low",
"last_affected": "8.22.0"
}
},
"related_cves": [
{
"value": "CVE-2026-87861",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 444358,
"published_at": "2026-10-14T08:00:00+00:00"
}