| Package | Affected versions | Patched versions |
|---|---|---|
| curl | ≥ 7.64.1, < 8.22.0 | 8.22.0 |
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free