CVE-2026-11564

Description

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Metadata

CVE ID: CVE-2026-11564
State: PUBLISHED
Assigner: curl
Reserved: 2026-06-08 08:22 UTC
Published: 2026-07-03 06:12 UTC
Last updated: 2026-07-03 06:12 UTC
Vendor / Product: curl / curl
Sources: cve.org · NVD

Severity & Metrics

No CVSS data available.

Affected products (1)

Vendor	Product	Platform	Versions
curl	curl	—	8.20.0 ≤ 8.20.0, 8.19.0 ≤ 8.19.0, 8.18.0 ≤ 8.18.0, 8.17.0 ≤ 8.17.0

Weakness (CWE)

CWE	Source	Description
—	cna	CWE-295 Improper Certificate Validation

References (3)

json https://curl.se/docs/CVE-2026-11564.json
www https://curl.se/docs/CVE-2026-11564.html
issue https://hackerone.com/reports/3788984

Back to overview