CVE-2026-80231: native CA store conn reuse
Published Sep 6, 2026
·Updated
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (CURLSSLOPTNATIVECA) than when the connection was created.
Affected Software
2 affected components
redhat/libcurl
haxx curl>=7.71.0<8.22.0
Remediation
Patch Available
Event History
Sep 6, 2026
CVE Published
via MITRE·05:48 PM
Data Sourced
via MITRE·05:48 PM
DescriptionWeakness
Data Sourced
via NVD·06:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Sep 8, 2026
Data Sourced
via Microsoft·08:02 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What application behavior should be reviewed to identify potential exposure?
Review HTTPS clients that may reuse existing connections to the same hostname while changing the CURLSSLOPT_NATIVE_CA setting between requests or transfers.
2
Is connection reuse part of the affected scenario?
Yes. The flaw involves reuse of an existing HTTPS connection that was established with a different Native CA Store setting.