CVE-2026-87861
Fixed in a distro release EPSS <1%
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.
Products: curl
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.23 | curl | 8.23.0-r0 |
| Alpine 3.24 | curl | 8.23.0-r0 |
| Debian 14 | curl | no fix |
| Red Hat hummingbird 1 | curl | 0:8.23.0-0.1.hum1 |
| Red Hat hummingbird 1 | libcurl | 0:8.23.0-0.1.hum1 |
| Red Hat hummingbird 1 | libcurl-devel | 0:8.23.0-0.1.hum1 |
| Red Hat hummingbird 1 | libcurl-minimal | 0:8.23.0-0.1.hum1 |
| openSUSE Tumbleweed | curl | 8.23.0-1.1 |