CVE-2026-87861 is a vulnerability in Haxx Curl
Published on October 20, 2026
cross-origin reuse of a Negotiate connection
When using ambient user credentials, an HTTP request directed to one origin
may be dispatched over a connection previously authenticated via Negotiate for
a different origin, leaving the request's intended credentials unused.
Products Associated with CVE-2026-87861
Want to know whenever a new CVE is published for Haxx Curl? stack.watch will email you.
Affected Versions
curl:- Version 8.22.0, <= 8.22.0 is affected.
- Version 8.21.0, <= 8.21.0 is affected.