CVE-2026-107929: local interface connection reuse mixup
local interface connection reuse mixup
Other sources
When CURLOPTINTERFACE (or the command line tool's --interface option) is set with one of the documented prefixes (if!, host!, ifhost!), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.20.0-2ubuntu11.1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.18.0-1ubuntu2.8 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u15Fixed in 7.88.1-10+deb12u5Fixed in 8.23.0-1 - Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 8.23.0-r0
Event History
Frequently Asked Questions
Which uses of curl are affected?
The issue applies to libcurl transfers using CURLOPT_INTERFACE and to curl command-line transfers using --interface when the option uses one of the documented if!, host!, or ifhost! prefixes.
When can the requested source differ from the source actually used?
It can occur when a later transfer requests a different source but reuses an existing connection created by an earlier transfer. The reused connection can continue using the earlier transfer's source address.