CVE-2026-5545
Publication date 29 April 2026
Last updated 29 April 2026
Ubuntu priority
Description
libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host.
Mitigation
Avoid using HTTP Negotiate in your application
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| curl | 26.04 LTS resolute |
Needs evaluation
|
| 25.10 questing |
Vulnerable
|
|
| 24.04 LTS noble |
Vulnerable
|
|
| 22.04 LTS jammy |
Vulnerable
|
|
| 20.04 LTS focal |
Vulnerable
|
|
| 18.04 LTS bionic |
Vulnerable
|
|
| 16.04 LTS xenial |
Vulnerable
|
|
| 14.04 LTS trusty |
Vulnerable
|