Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U N H N 6.5 .0032 24.3 —
AFFECTED Product Versions Fixed curl 8.20.0 – —
TIMELINE May 13 Reserved by curl Jul 3 EXPLOIT PUBLISHED — CVE-2026-8458 (curl). Public exploit reference added. Jul 3 Published (CNA: curl)
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.
| Date | Event | Detail |
|---|---|---|
| May 13, 2026 | Reserved | Reserved by curl |
| July 3, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-8458 (curl). Public exploit reference added. |
| July 3, 2026 | Published | Published (CNA: curl) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| curl | curl | — | 8.20.0 | — |
Authoritative record: CVE-2026-8458 at cve.org
Vendors: curl
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-8458 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.