CVE-2011-2192: Apple Mac OS X

Medium severity, CVSS 4.3. EPSS: 2.9% chance of exploitation in the next 30 days.

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.

Affected products

• Apple Mac OS X: before 10.7.3 (fixed in 10.7.3)
• Canonical Ubuntu Linux: version 8.04 only; version 10.04 only; version 10.10 only; version 11.04 only
• Debian Debian Linux: version 5.0 only; version 6.0 only; version 7.0 only
• Fedoraproject Fedora: version 14 only; version 15 only
• Haxx Libcurl: from 7.10.6, up to and including 7.21.6

Published 2011-07-07. Last modified 2026-06-16.