CVE-2026-80231: native CA store conn reuse
Published Sep 6, 2026
·Updated
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (CURLSSLOPTNATIVECA) than when the connection was created.
Event History
Sep 6, 2026
CVE Published
via MITRE·05:48 PM
Data Sourced
via MITRE·05:48 PM
DescriptionWeakness
Frequently Asked Questions
1
What application behavior should be reviewed to identify potential exposure?
Review HTTPS clients that may reuse existing connections to the same hostname while changing the CURLSSLOPT_NATIVE_CA setting between requests or transfers.
2
Is connection reuse part of the affected scenario?
Yes. The flaw involves reuse of an existing HTTPS connection that was established with a different Native CA Store setting.