CVE-2023-27536
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user per…
Published Mar 30, 2023 · updated Oct 14, 2026 · haxx libcurl
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.
Timeline
Detection, updates, and resolution for this record.
Mar 30, 2023 · NIST NVD
Detected
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information.
Oct 14, 2026 · NIST NVD
Updated
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information.
Affected
- cpe debian/debian linux10.0
- cpe fedoraproject/fedora36
- cpe haxx/libcurlversion unspecified
- cpe netapp/active iq unified managerversion unspecified
- cpe netapp/h300s firmwareversion unspecified
- cpe netapp/h410s firmwareversion unspecified
- cpe netapp/h500s firmwareversion unspecified
- cpe netapp/h700s firmwareversion unspecified
- cpe netapp/ontap9
- cpe splunk/universal forwarderversion unspecified
Sources
- CVE.orgCVE-2023-27536
Official CVE identifier
cve.org - FIRST EPSSCVE-2023-27536
30-day exploitation probability 1.8%
first.org - NIST NVDCVE-2023-27536
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affect
nvd.nist.gov