CURL-CVE-2026-11564: Native CA trust persist
Published Jul 3, 2026
·Updated
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.
An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.
Affected Software
1 affected component
curl libcurl
Event History
Jul 3, 2026
CVE Published
via OSV·06:12 AM
Data Sourced
via OSV·06:12 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which application patterns are exposed?
Applications are exposed when they reuse the same libcurl easy handle, first perform a transfer using the default native CA trust, and later switch that handle to custom CA material. A previously pooled connection can be reused if it matches the later transfer setup.
2
Does switching an existing easy handle to custom CA material ensure that later transfers use only that custom trust?
No. A connection previously established using the native platform trust store can continue to be reused after the handle is switched to custom CA material.