CVE-2026-8932

Published Jul 3, 2026

Last updated a month ago

CVSS high 7.5
Curl
Libcurl
HTTP

Overview

Description
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.
Source
2499f714-1537-4658-8207-48ae4bb9eae9
NVD status
Modified
Products
curl

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.5
Impact score
3.6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity
HIGH

Weaknesses

2499f714-1537-4658-8207-48ae4bb9eae9
CWE-305
nvd@nist.gov
NVD-CWE-Other

Social media

Hype score
Not currently trending

  1. Curl maintainers patched CVE-2026-8932, an mTLS authentication-bypass bug sitting undetected in libcurl since Feb 2001. Found by an AI audit from Aisle, not 25 years of manual review. Library runs on 20B+ devices, per TechTarget/SecurityWeek. https://t.co/7h2q95cdji

    @CisoMarketplace

    18 Oct 2026

    5 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. šŸ“¢ CVE-2026-8932 | CVSS 7.5 | šŸšØ PoC šŸ” libcurl mTLS Auth Bypass Reused connections may bypass updated client authentication checks, allowing requests without re-authentication. https://t.co/0pSTgJD2gI

    @vulnerbyte

    26 Sept 2026

    35 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

Related CVEs

  1. With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.ā€¢CVE-2026-82208
  2. When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.ā€¢CVE-2026-80230
  3. A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.ā€¢CVE-2026-80231
  4. When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).ā€¢CVE-2026-82209
  5. A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.ā€¢CVE-2026-80255

References

Sources include official advisories and independent security research.