CVE-2026-82208: wolfSSL CA-cache hit overrides callback
Published Sep 6, 2026
·Updated
With the wolfSSL backend, when CA caching is enabled and an CURLOPTSSLCTXFUNCTION callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.
Affected Software
1 affected component
libcurl
Event History
Sep 6, 2026
CVE Published
via MITRE·05:49 PM
Data Sourced
via MITRE·05:49 PM
DescriptionWeakness
Frequently Asked Questions
1
Which libcurl deployments are exposed to this behavior?
Only deployments using the wolfSSL backend are described as affected, and exploitation also requires CA caching to be enabled plus a CURLOPT_SSL_CTX_FUNCTION callback that replaces the trust store.
2
What must an attacker present for certificate verification to be bypassed?
The attacker needs a certificate that is trusted by the cached CA store but would be rejected by the trust store selected by the callback. After the callback returns, libcurl can reinstall the cached store and accept that certificate.