Description
The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 7.21.6-2 | — |
| Debian 13 | curl | 7.21.6-2 | — |
| Debian 12 | curl | 7.21.6-2 | — |
| Debian 6.0 | curl | 7.21.0-2 | DSA-2271-1 |
| Debian 5.0 | curl | 7.18.2-8lenny5 | DSA-2271-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | curl +2 | 7.19.7-26.el6_1.1 | RHSA-2011:0918 |
| RHEL 5 | curl +1 | 7.15.5-9.el5_6.3 | RHSA-2011:0918 |
| RHEL 4 | curl +1 | 7.12.1-17.el4 | RHSA-2011:0918 |
Advisories 2
- RHSA-2011:0918 Red Hat Security Advisory: curl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2271-1 curl - improper delegation of client credentials Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDVSA-2011:116 vendor-advisory
- 45181 third-party-advisory
- http://support.apple.com/kb/HT5130
- 45144 third-party-advisory
- USN-1158-1 vendor-advisory
- http://curl.haxx.se/docs/adv_20110623.html
- 45067 third-party-advisory
- FEDORA-2011-8640 vendor-advisory
- 1025713 vdb-entry
- RHSA-2011:0918 vendor-advisory
- APPLE-SA-2012-02-01-1 vendor-advisory
- GLSA-201203-02 vendor-advisory
- 48256 third-party-advisory
- DSA-2271 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=711454
- http://curl.haxx.se/curl-gssapi-delegation.patch
- 45088 third-party-advisory
- FEDORA-2011-8586 vendor-advisory
- 45047 third-party-advisory