CVE-2026-107929: local interface connection reuse mixup
When CURLOPTINTERFACE (or the command line tool's --interface option) is set with one of the documented prefixes (if!, host!, ifhost!), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Specify the interface using one of the documented prefixes: if!, host!, or ifhost!, to ensure the source binding is considered during connection reuse.
curl CURLOPT_INTERFACE / --interface = if!, host!, or ifhost!
Event History
Frequently Asked Questions
Which uses of curl are affected?
The issue applies to libcurl transfers using CURLOPT_INTERFACE and to curl command-line transfers using --interface when the option uses one of the documented if!, host!, or ifhost! prefixes.
When can the requested source differ from the source actually used?
It can occur when a later transfer requests a different source but reuses an existing connection created by an earlier transfer. The reused connection can continue using the earlier transfer's source address.