CVE-2026-8932 | libcurl would reuse a previously created connection even whe…

Description

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

Metadata

CVE ID: CVE-2026-8932
State: PUBLISHED
Assigner: curl
Reserved: 2026-05-19 08:56 UTC
Published: 2026-07-03 06:16 UTC
Last updated: 2026-07-03 06:16 UTC
Vendor / Product: curl / curl
Sources: cve.org · NVD

Severity & Metrics

No CVSS data available.

Affected products (1)

Vendor	Product	Platform	Versions
curl	curl	—	8.20.0 ≤ 8.20.0, 8.19.0 ≤ 8.19.0, 8.18.0 ≤ 8.18.0, 8.17.0 ≤ 8.17.0 …

Weakness (CWE)

CWE	Source	Description
—	cna	CWE-305 Authentication Bypass by Primary Weakness

References (3)