CVE-2011-2192: The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and...

Security readout for executives and security teams

A flaw in older libcurl versions could hand a user’s delegated GSSAPI credentials to a remote server during Negotiate authentication. A malicious or compromised server could then impersonate that client in GSSAPI-backed services. This matters most where Kerberos/GSSAPI single sign-on is still used with legacy curl/libcurl builds. Exposure is most likely on legacy systems, appliances, or embedded applications bundling libcurl 7.10.6 through 7.21.6 and using GSSAPI/Negotiate authentication. Modern vendor-maintained packages are less likely exposed if 2011-era security updates were applied. Prioritize remediation where Kerberos/GSSAPI authentication and old libcurl are still present. This is not a broad internet-facing server flaw by itself, but it can turn a connection to an untrusted server into credential impersonation risk. Mitigation focus: Upgrade curl/libcurl using vendor advisories addressing CVE-2011-2192.; Remove or isolate unsupported builds using libcurl 7.10.6 through 7.21.6.; Review bundled third-party software for statically linked or vendored libcurl..

Prepared

Jun 27, 2026, 18:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.