CVE-2026-5545 - Vulnerability Analysis

Overview

libcurl contains an authentication bypass caused by incorrect connection reuse logic in the connection pool, letting attackers send requests with wrong credentials, exploit requires multiple authenticated requests to the same host.

Severity & Score

Impact

Attackers can send requests using another user's authenticated connection, potentially leading to unauthorized access or data leakage.

Mitigation

Update to the latest libcurl version with the connection reuse fix.

References

• https://hackerone.com/reports/3642555
• https://curl.se/docs/CVE-2026-5545.html
• https://curl.se/docs/CVE-2026-5545.json

Social Media Activity(1 post)

daniel:// stenberg://

@bagder

Apr 29, 2026

Out of the eight new #curl CVEs, four of them had existed in code for over twenty years when we published. CVE-2026-5545 clocks in at 22.75 years old CVE-2026-7168 at 21.91 years CVE-2026-6429 at 20.95 years CVE-2026-6253 at 20.66 years And yet CVE-2026-5545 only becomes the 5th oldest vulnerability ever found in curl so far.

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner