Homepage

Authentication Bypass by Primary Weakness The advisory has been revoked - it doesn't affect any version of package jbcs-httpd24-curl  (opens in a new tab)

Threat Intelligence

EPSS
0.37% (31st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-JBCSHTTPD24CURL-20670950
  • published9 Oct 2026
  • disclosed3 Jul 2026
Report a new vulnerability Found a mistake?

Introduced: 3 Jul 2026

CVE-2026-8458  (opens in a new tab)
CWE-305  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream jbcs-httpd24-curl package and not the jbcs-httpd24-curl package as distributed by RHEL.

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services".

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.