CURL-CVE-2026-8932: incomplete mTLS config matching in conn reuse
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require attacker authentication or user interaction?
The CVSS vector indicates network attack access with low complexity, no privileges required, and no user interaction required.
What is the stated security impact?
The CVSS vector rates integrity impact as high. It lists no confidentiality impact and no availability impact.
Which application behavior is affected?
Applications using libcurl connection pooling are affected when a connection is reused after mTLS-related settings that should prevent reuse have changed, particularly settings related to the private key.