CVE-2026-8932: incomplete mTLS config matching in conn reuse
incomplete mTLS config matching in conn reuse
Other sources
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.1-10 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.21.0-2Fixed in 8.22.0~rc2-2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8932?
CVE-2026-8932 has a risk rating of 21, indicating a significant security concern.
How does CVE-2026-8932 affect libcurl's connection management?
CVE-2026-8932 allows libcurl to reuse a connection even when mTLS configuration changes occur that should have prevented the reuse.
What are the potential risks of exploiting CVE-2026-8932?
Exploiting CVE-2026-8932 could lead to unauthorized access or data leakage due to improper mTLS connection handling.
How can I fix CVE-2026-8932 in my application?
To fix CVE-2026-8932, you should update libcurl to the latest version where the issue has been resolved.
When was CVE-2026-8932 published?
CVE-2026-8932 was published on July 3, 2026.