curl / libcurl CVE-2026-80231
HIGHSeverity by source
Network MITM required (AC:H); native CA store path is non-default; user must initiate the curl request (UI:R); confidentiality and integrity fully compromised if CA bypass succeeds.
Lifecycle Timeline
2Description PRE-NVD
AnalysisAI
Connection reuse logic in curl's native CA store code path fails to properly isolate connections that were established under differing CA verification contexts, potentially allowing a subsequent request to reuse a connection whose native-CA validation would not have succeeded independently. All curl and libcurl users on platforms using the OS-native certificate store (Windows CertStore, macOS Keychain, etc.) rather than curl's bundled CA bundle are affected in versions up to and including 8.21.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the curl client must be configured or defaulting to use the native OS CA store backend (Schannel on Windows, Secure Transport on macOS, or NSS/GnuTLS native store integration) rather than curl's bundled CA bundle - this is platform-dependent and not universal; (2) an existing pooled connection must be available for reuse across requests with differing CA verification contexts; (3) the attacker must control or influence which server or URL the second request targets (e.g., MITM network position, DNS manipulation, or server-side redirect). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector or score is provided in the input data, requiring independent assessment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade curl and libcurl to version 8.22.0 or later, released September 2, 2026 (https://curl.se/docs/vuln-8.21.0.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all curl and libcurl usage and versions in the environment (development, CI/CD, production), with special attention to macOS and Windows systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today