CVE-2026-8458: wrong reuse for different services

Summary:

I found an incomplete-fix variant of CVE-2026-5545 in curl/libcurl 8.20.0.

libcurl 8.20.0 still wrongly reuses an HTTP Negotiate-authenticated connection for a later request to the same host even when the requested service principal changes via CURLOPT_SERVICE_NAME / --service-name.

In my reproduction, request 1 authenticates a persistent HTTP connection for service principal svcA. Request 2 then targets svcB on the same host, but libcurl reuses the already authenticated connection, sends no new Authorization header for svcB, and performs no new Negotiate handshake for svcB. The server still serves the svcB request under the auth context previously established for svcA.

This is wrong authenticated connection reuse across changed service principals.

This appears to be an incomplete-fix variant of CVE-2026-5545, which addressed wrong reuse of HTTP Negotiate-authenticated connections but did not cover service-principal changes in the reproduced path.