CVE-2012-4545: The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6...

Security readout for executives and security teams

ELinks could unintentionally hand delegated GSSAPI credentials to a remote web server during HTTP Negotiate authentication. In a Kerberos-style environment, that server may then authenticate as the user elsewhere. The public bundle does not provide CVSS, KEV listing, or evidence of active exploitation. Exposure is most likely where ELinks is installed and used with HTTP Negotiate, GSS-Negotiate, or Kerberos/GSSAPI authentication against remote or untrusted web servers. General web browsing without those authentication mechanisms is not clearly exposed by the provided sources. Treat as targeted but meaningful credential-risk debt. It deserves prompt cleanup in Kerberos/GSSAPI environments, especially on administrative workstations or systems accessing internal resources. It is not supported as internet-wide emergency risk by the provided evidence. Mitigation focus: Upgrade ELinks to 0.12pre6 or a vendor-fixed package.; Prioritize systems using Kerberos, GSSAPI, or HTTP Negotiate authentication.; Review Debian, Red Hat, Mandriva, or distribution advisories for package-specific fixes..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.