CVE-2026-8932

EUVD-2026-41509

03.07.2026, 07:16

libcurl would reuse a previously created connection even when some mTLS config
related option had been changed that should have prohibited reuse.

libcurl keeps previously used connections in a connection pool for subsequent
transfers to reuse if one of them matches the setup. However, some TLS
settings related to client certificates were left out from the configuration
match checks, making them match too easily. In particular options related to
the private key.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
curl	CNA	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 31.41%

Affected Products (NVD)

Vendor	Product	Version
haxx	curl	7.7 ≤ 𝑥 < 8.21.0

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
curl	curl	7.7.0 ≤ 𝑥 < 8.14.2	CNA
curl	curl	8.15.0 ≤ 𝑥 < 8.16.1	CNA
curl	curl	8.17.0 ≤ 𝑥 < 8.20.1	CNA
curl	curl	8.20.0	CNA
curl	curl	8.19.0	CNA
curl	curl	8.18.0	CNA
curl	curl	8.17.0	CNA
curl	curl	8.16.0	CNA
curl	curl	8.15.0	CNA
curl	curl	8.14.1	CNA
curl	curl	8.14.0	CNA
curl	curl	8.13.0	CNA
curl	curl	8.12.1	CNA
curl	curl	8.12.0	CNA
curl	curl	8.11.1	CNA
curl	curl	8.11.0	CNA
curl	curl	8.10.1	CNA
curl	curl	8.10.0	CNA
curl	curl	8.9.1	CNA
curl	curl	8.9.0	CNA
curl	curl	8.8.0	CNA
curl	curl	8.7.1	CNA
curl	curl	8.7.0	CNA
curl	curl	8.6.0	CNA
curl	curl	8.5.0	CNA
curl	curl	8.4.0	CNA
curl	curl	8.3.0	CNA
curl	curl	8.2.1	CNA
curl	curl	8.2.0	CNA
curl	curl	8.1.2	CNA
curl	curl	8.1.1	CNA
curl	curl	8.1.0	CNA
curl	curl	8.0.1	CNA
curl	curl	8.0.0	CNA
curl	curl	7.88.1	CNA
curl	curl	7.88.0	CNA
curl	curl	7.87.0	CNA
curl	curl	7.86.0	CNA
curl	curl	7.85.0	CNA
curl	curl	7.84.0	CNA
curl	curl	7.83.1	CNA
curl	curl	7.83.0	CNA
curl	curl	7.82.0	CNA
curl	curl	7.81.0	CNA
curl	curl	7.80.0	CNA
curl	curl	7.79.1	CNA
curl	curl	7.79.0	CNA
curl	curl	7.78.0	CNA
curl	curl	7.77.0	CNA
curl	curl	7.76.1	CNA
curl	curl	7.76.0	CNA
curl	curl	7.75.0	CNA
curl	curl	7.74.0	CNA
curl	curl	7.73.0	CNA
curl	curl	7.72.0	CNA
curl	curl	7.71.1	CNA
curl	curl	7.71.0	CNA
curl	curl	7.70.0	CNA
curl	curl	7.69.1	CNA
curl	curl	7.69.0	CNA
curl	curl	7.68.0	CNA
curl	curl	7.67.0	CNA
curl	curl	7.66.0	CNA
curl	curl	7.65.3	CNA
curl	curl	7.65.2	CNA
curl	curl	7.65.1	CNA
curl	curl	7.65.0	CNA
curl	curl	7.64.1	CNA
curl	curl	7.64.0	CNA
curl	curl	7.63.0	CNA
curl	curl	7.62.0	CNA
curl	curl	7.61.1	CNA
curl	curl	7.61.0	CNA
curl	curl	7.60.0	CNA
curl	curl	7.59.0	CNA
curl	curl	7.58.0	CNA
curl	curl	7.57.0	CNA
curl	curl	7.56.1	CNA
curl	curl	7.56.0	CNA
curl	curl	7.55.1	CNA
curl	curl	7.55.0	CNA
curl	curl	7.54.1	CNA
curl	curl	7.54.0	CNA
curl	curl	7.53.1	CNA
curl	curl	7.53.0	CNA
curl	curl	7.52.1	CNA
curl	curl	7.52.0	CNA
curl	curl	7.51.0	CNA
curl	curl	7.50.3	CNA
curl	curl	7.50.2	CNA
curl	curl	7.50.1	CNA
curl	curl	7.50.0	CNA
curl	curl	7.49.1	CNA
curl	curl	7.49.0	CNA
curl	curl	7.48.0	CNA
curl	curl	7.47.1	CNA
curl	curl	7.47.0	CNA
curl	curl	7.46.0	CNA
curl	curl	7.45.0	CNA
curl	curl	7.44.0	CNA
curl	curl	7.43.0	CNA
curl	curl	7.42.1	CNA
curl	curl	7.42.0	CNA
curl	curl	7.41.0	CNA
curl	curl	7.40.0	CNA
curl	curl	7.39.0	CNA
curl	curl	7.38.0	CNA
curl	curl	7.37.1	CNA
curl	curl	7.37.0	CNA
curl	curl	7.36.0	CNA
curl	curl	7.35.0	CNA
curl	curl	7.34.0	CNA
curl	curl	7.33.0	CNA
curl	curl	7.32.0	CNA
curl	curl	7.31.0	CNA
curl	curl	7.30.0	CNA
curl	curl	7.29.0	CNA
curl	curl	7.28.1	CNA
curl	curl	7.28.0	CNA
curl	curl	7.27.0	CNA
curl	curl	7.26.0	CNA
curl	curl	7.25.0	CNA
curl	curl	7.24.0	CNA
curl	curl	7.23.1	CNA
curl	curl	7.23.0	CNA
curl	curl	7.22.0	CNA
curl	curl	7.21.7	CNA
curl	curl	7.21.6	CNA
curl	curl	7.21.5	CNA
curl	curl	7.21.4	CNA
curl	curl	7.21.3	CNA
curl	curl	7.21.2	CNA
curl	curl	7.21.1	CNA
curl	curl	7.21.0	CNA
curl	curl	7.20.1	CNA
curl	curl	7.20.0	CNA
curl	curl	7.19.7	CNA
curl	curl	7.19.6	CNA
curl	curl	7.19.5	CNA
curl	curl	7.19.4	CNA
curl	curl	7.19.3	CNA
curl	curl	7.19.2	CNA
curl	curl	7.19.1	CNA
curl	curl	7.19.0	CNA
curl	curl	7.18.2	CNA
curl	curl	7.18.1	CNA
curl	curl	7.18.0	CNA
curl	curl	7.17.1	CNA
curl	curl	7.17.0	CNA
curl	curl	7.16.4	CNA
curl	curl	7.16.3	CNA
curl	curl	7.16.2	CNA
curl	curl	7.16.1	CNA
curl	curl	7.16.0	CNA
curl	curl	7.15.5	CNA
curl	curl	7.15.4	CNA
curl	curl	7.15.3	CNA
curl	curl	7.15.2	CNA
curl	curl	7.15.1	CNA
curl	curl	7.15.0	CNA
curl	curl	7.14.1	CNA
curl	curl	7.14.0	CNA
curl	curl	7.13.2	CNA
curl	curl	7.13.1	CNA
curl	curl	7.13.0	CNA
curl	curl	7.12.3	CNA
curl	curl	7.12.2	CNA
curl	curl	7.12.1	CNA
curl	curl	7.12.0	CNA
curl	curl	7.11.2	CNA
curl	curl	7.11.1	CNA
curl	curl	7.11.0	CNA
curl	curl	7.10.8	CNA
curl	curl	7.10.7	CNA
curl	curl	7.10.6	CNA
curl	curl	7.10.5	CNA
curl	curl	7.10.4	CNA
curl	curl	7.10.3	CNA
curl	curl	7.10.2	CNA
curl	curl	7.10.1	CNA
curl	curl	7.10	CNA
curl	curl	7.9.8	CNA
curl	curl	7.9.7	CNA
curl	curl	7.9.6	CNA
curl	curl	7.9.5	CNA
curl	curl	7.9.4	CNA
curl	curl	7.9.3	CNA
curl	curl	7.9.2	CNA
curl	curl	7.9.1	CNA
curl	curl	7.9	CNA
curl	curl	7.8.1	CNA
curl	curl	7.8	CNA
curl	curl	7.7.3	CNA
curl	curl	7.7.2	CNA
curl	curl	7.7.1	CNA
curl	curl	7.7	CNA

Debian Releases

Debian Product

Codename

curl

bookworm	postponed
bookworm (security)	vulnerable
bullseye	postponed
forky	8.22.0-1 fixed
sid	8.23.0~rc2-1 fixed
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

curl

bionic	Fixed 7.58.0-2ubuntu3.24+esm12 released
focal	Fixed 7.68.0-1ubuntu2.25+esm7 released
jammy	Fixed 7.81.0-1ubuntu1.27 released
noble	Fixed 8.5.0-2ubuntu10.13 released
questing	ignored
resolute	Fixed 8.18.0-1ubuntu2.5 released
trusty	ignored
xenial	ignored

Amazon Linux Releases

Amazon Package

Release

curl

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

curl-debuginfo

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

curl-debugsource

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

curl-minimal

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

curl-minimal-debuginfo

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

libcurl

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

libcurl-debuginfo

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

libcurl-devel

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

libcurl-minimal

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

libcurl-minimal-debuginfo

Amazon Linux 2023

0:8.21.0-5.amzn2023.0.1

fixed

Azure Linux Releases

Azure Package

Release

cmake

Azure Linux 3.0

0:3.30.3-15.azl3

fixed

curl

Azure Linux 3.0

0:8.11.1-10.azl3

fixed

Known Exploits!

Common Weakness Enumeration

CWE-305 - Authentication Bypass by Primary Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

References

https://curl.se/docs/CVE-2026-8932.html

https://curl.se/docs/CVE-2026-8932.json

https://hackerone.com/reports/3733910