CVE-2026-86415
EUVD-2026-10530720.10.2026, 21:17
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.Enginsight
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| curl | curl | 𝑥 ≤ 8.22.0 | CNA |
| curl | curl | 𝑥 ≤ 8.21.0 | CNA |
Debian Releases
Ubuntu Releases
Vulnerability Media Exposure