Skip to main content

curl CVE-2026-8286

| EUVDEUVD-2026-41503 HIGH
Improper Certificate Validation (CWE-295)
2026-06-24 GHSA-32xh-3x3c-6g6h
Information Disclosure Curl Haxx
8.1
CVSS 3.1 · Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Application reuses libcurl handle across transfers
  2. Delivery
    First STARTTLS transfer opens live connection with lenient TLS
  3. Exploit
    New transfer requests stricter TLS config
  4. Execution
    Reuse logic wrongly matches mismatched connection
  5. Persist
    Data sent over improperly-secured channel
  6. Impact
    Confidential data exposed / integrity broken

Vulnerability Assessment

Weakness
CWE
CWE-295
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate validation
Exploitation Conditions

Exploitation requires an application using curl/libcurl that performs multiple transfers over a STARTTLS-upgraded protocol (SMTP, IMAP, POP3, FTP with explicit TLS) while connection reuse is enabled, where a live connection already exists and a subsequent transfer specifies a DIFFERENT (typically stricter) TLS configuration that the reuse-matching logic fails to distinguish. Limiting factors that reduce realistic risk: the vulnerable reuse only occurs within the same connection cache/handle context, so single-transfer or fresh-connection deployments are unaffected; the attacker generally must be positioned to benefit from the weaker TLS context (network man-in-the-middle, or control of a server that the stricter settings would have rejected); and it depends on the application actually mixing differing TLS configs across transfers. This is not a plain remote-unauthenticated exploit against a default single request despite the CVSS AV:N/AC:L rating.
Impact

Signals are mixed and point to a real but non-urgent priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:N) yields 8.1 High, but the AC:L/PR:L ratings are questionable for this class: exploitation is not a single remote request - it depends on an application (via libcurl) performing multiple transfers within the same handle/connection-cache where a live mismatched STARTTLS connection already exists and is eligible for reuse, which is more consistent with higher attack complexity and no direct client authentication. EPSS is low (0.20%, 9th percentile) and there is no KEV listing, so widespread opportunistic exploitation is unlikely; realistic risk is confined to specific applications and multi-transfer usage patterns. The primary harm is confidentiality/integrity - sensitive data sent over a connection that does not honor the caller's intended TLS security, undermining verification guarantees. Conflict to verify with the vendor: CVSS marks AC:L but the description implies an internal reuse condition rather than direct attacker-driven network access, so treat the raw 8.1 as an upper bound.
Exploit ScenarioDerived

An application uses libcurl to perform several STARTTLS-based transfers (for example an automated SMTP or IMAP client) reusing a single handle; a first transfer establishes a live connection with lenient TLS settings, and a later transfer intended to use strict certificate verification is silently placed on that existing mismatched connection. Sensitive credentials or message data are then transmitted over a channel that does not honor the intended TLS security, exposing them to a network-positioned attacker or to a server that stricter settings would otherwise have rejected. No public exploit code is identified; the HackerOne report (3718195) reflects coordinated disclosure rather than a weaponized POC.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 06, 2026

Information disclosure and integrity exposure in curl/libcurl occurs when a new transfer that uses STARTTLS to upgrade a connection may reuse an already-established live connection whose TLS configuration does not match the requested one, so data intended for a strictly-configured secure channel can traverse a connection negotiated under different (potentially weaker or unverified) TLS settings. The flaw affects a very wide range of curl releases from 7.30.0 through 8.20.0 and is tagged as Information Disclosure with high confidentiality and integrity impact (CVSS 8.1). It is not listed in CISA KEV, EPSS is low (0.20%, 9th percentile), and no public exploit code is identified at time of analysis.

Earlier versions of this analysis (2)
v2 Jul 06, 2026 - 18:41 cvss changed CVSS 8.1

Improper TLS connection reuse in curl (libcurl) lets a new transfer that upgrades a connection via STARTTLS silently reuse an existing pooled connection even when the TLS configuration does not match, potentially routing sensitive data over a connection that fails the caller's intended security parameters. The flaw affects a very broad range of curl releases (from 7.30.0 through 8.20.0 per EUVD) and is classed as Information Disclosure; there is no public exploit identified at time of analysis and no CISA KEV listing, with EPSS at a low 0.20% (9th percentile).

v1 Jun 24, 2026 - 18:30

Wrong STARTTLS connection reuse in curl/libcurl allows the connection pool to incorrectly match and reuse a connection that was established using the STARTTLS protocol upgrade mechanism for a subsequent transfer where that reuse is inappropriate - potentially bypassing the TLS security that STARTTLS was intended to provide. This affects applications using libcurl with email and directory protocols supporting STARTTLS (SMTP, IMAP, POP3, LDAP) where connection pooling is active across transfers. No public exploit or active CISA KEV exploitation has been identified; the curl project rates this LOW severity, and the fix ships in curl 8.21.0, released June 24, 2026.

RemediationAI

Patch available per vendor advisory: upgrade curl/libcurl to the fixed release published by the curl project (see https://curl.se/docs/CVE-2026-8286.html for the exact patched version; no specific fix version is included in the provided data, so confirm it there rather than assuming one). Distribution users should apply the vendor-packaged update, e.g. per Ubuntu USN-8487-1 at https://ubuntu.com/security/notices/USN-8487-1, and rebuild or restart applications that statically or dynamically link libcurl so the fixed library is actually loaded. Where immediate patching is not possible, compensating controls include disabling connection reuse so each transfer opens a fresh connection (CURLOPT_FORBID_REUSE / CURLOPT_FRESH_CONNECT in libcurl, or --no-keepalive at the tool level), and using separate curl/libcurl handles for transfers that require different TLS configurations so mismatched connections are never pooled together; the trade-off is loss of connection-reuse performance and added handshake overhead. Cross-referenced advisories in the same disclosure batch include curl CVE-2026-11564, CVE-2026-12064, and CVE-2026-9080, so review those together when scheduling the upgrade.

Affected VersionsENISA

curl 7.55.0 ≤7.55.0
curl 7.47.0 ≤7.47.0
curl 7.61.0 ≤7.61.0
curl 7.57.0 ≤7.57.0
curl 7.70.0 ≤7.70.0
curl 7.65.2 ≤7.65.2
curl 7.36.0 ≤7.36.0
curl 7.50.3 ≤7.50.3
curl 7.85.0 ≤7.85.0
curl 7.81.0 ≤7.81.0
curl 7.38.0 ≤7.38.0
curl 7.33.0 ≤7.33.0
curl 8.2.1 ≤8.2.1
curl 7.65.0 ≤7.65.0
curl 7.42.1 ≤7.42.1
curl 7.72.0 ≤7.72.0
curl 7.59.0 ≤7.59.0
curl 7.31.0 ≤7.31.0
curl 7.34.0 ≤7.34.0
curl 8.2.0 ≤8.2.0
curl 7.87.0 ≤7.87.0
curl 7.64.0 ≤7.64.0
curl 7.51.0 ≤7.51.0
curl 8.0.1 ≤8.0.1
curl 7.58.0 ≤7.58.0
curl 7.76.1 ≤7.76.1
curl 7.71.1 ≤7.71.1
curl 7.74.0 ≤7.74.0
curl 7.79.0 ≤7.79.0
curl 8.4.0 ≤8.4.0
curl 7.73.0 ≤7.73.0
curl 8.9.0 ≤8.9.0
curl 8.14.1 ≤8.14.1
curl 7.80.0 ≤7.80.0
curl 7.49.1 ≤7.49.1
curl 7.61.1 ≤7.61.1
curl 8.13.0 ≤8.13.0
curl 7.43.0 ≤7.43.0
curl 7.54.1 ≤7.54.1
curl 7.54.0 ≤7.54.0
curl 8.7.0 ≤8.7.0
curl 7.66.0 ≤7.66.0
curl 7.64.1 ≤7.64.1
curl 7.39.0 ≤7.39.0
curl 8.18.0 ≤8.18.0
curl 7.53.0 ≤7.53.0
curl 7.62.0 ≤7.62.0
curl 7.69.0 ≤7.69.0
curl 7.56.0 ≤7.56.0
curl 8.12.0 ≤8.12.0
curl 7.48.0 ≤7.48.0
curl 7.65.3 ≤7.65.3
curl 7.49.0 ≤7.49.0
curl 7.35.0 ≤7.35.0
curl 7.88.0 ≤7.88.0
curl 7.56.1 ≤7.56.1
curl 8.1.0 ≤8.1.0
curl 8.20.0 ≤8.20.0
curl 7.68.0 ≤7.68.0
curl 7.32.0 ≤7.32.0
curl 7.65.1 ≤7.65.1
curl 7.78.0 ≤7.78.0
curl 7.82.0 ≤7.82.0
curl 7.40.0 ≤7.40.0
curl 8.5.0 ≤8.5.0
curl 7.69.1 ≤7.69.1
curl 7.46.0 ≤7.46.0
curl 8.19.0 ≤8.19.0
curl 7.71.0 ≤7.71.0
curl 8.3.0 ≤8.3.0
curl 7.41.0 ≤7.41.0
curl 7.75.0 ≤7.75.0
curl 8.0.0 ≤8.0.0
curl 7.37.0 ≤7.37.0
curl 7.50.2 ≤7.50.2
curl 8.16.0 ≤8.16.0
curl 7.52.1 ≤7.52.1
curl 7.76.0 ≤7.76.0
curl 8.7.1 ≤8.7.1
curl 7.44.0 ≤7.44.0
curl 8.10.1 ≤8.10.1
curl 8.6.0 ≤8.6.0
curl 7.86.0 ≤7.86.0
curl 8.11.1 ≤8.11.1
curl 7.63.0 ≤7.63.0
curl 8.15.0 ≤8.15.0
curl 7.50.0 ≤7.50.0
curl 8.12.1 ≤8.12.1
curl 8.9.1 ≤8.9.1
curl 7.30.0 ≤7.30.0
curl 7.53.1 ≤7.53.1
curl 8.1.2 ≤8.1.2
curl 8.14.0 ≤8.14.0
curl 7.37.1 ≤7.37.1
curl 8.8.0 ≤8.8.0
curl 7.50.1 ≤7.50.1
curl 7.52.0 ≤7.52.0
curl 7.42.0 ≤7.42.0
curl 7.84.0 ≤7.84.0
curl 7.55.1 ≤7.55.1
curl 7.88.1 ≤7.88.1
curl 7.47.1 ≤7.47.1
curl 7.83.0 ≤7.83.0
curl 7.67.0 ≤7.67.0
curl 7.83.1 ≤7.83.1
curl 8.10.0 ≤8.10.0
curl 7.60.0 ≤7.60.0
curl 7.77.0 ≤7.77.0
curl 7.45.0 ≤7.45.0
curl 8.1.1 ≤8.1.1
curl 8.17.0 ≤8.17.0
curl 7.79.1 ≤7.79.1
curl 8.11.0 ≤8.11.0

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

curl/libcurl maintains a connection cache and aggressively reuses established connections across transfers to avoid re-handshaking. For protocols that use STARTTLS (e.g. SMTP, IMAP, POP3, FTP with explicit TLS), a plaintext connection is upgraded in place to TLS. This bug is in the connection-reuse matching logic: a subsequent transfer carrying a different TLS configuration (differing verification, certificate, pinning, cipher, or version options) is incorrectly matched to and reused on an existing live connection whose TLS parameters differ, when it should have opened a fresh connection instead. The root cause is a connection-reuse/context-confusion issue (no CWE assigned in the source data; conceptually related to improper certificate/authentication validation and reuse-matching, e.g. CWE-295/CWE-863). The CPE-equivalent affected identifiers span the entire curl 7.x and 8.x product line as enumerated by the ENISA EUVD record (EUVD-2026-41503).

Know when Curl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vuln.today AI 7.4 HIGH

AC:H because it needs a pre-existing live STARTTLS connection with a mismatched TLS config eligible for reuse; PR:N as no auth to the client is required; C:H/I:H from data over an improperly-secured channel, A:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE 7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat 8.1 HIGH

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

3
Analysis Updated
Jul 06, 2026 - 18:41 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 06, 2026 - 18:41 vuln.today
v2 - CVSS changed
CVSS changed
Jul 06, 2026 - 18:22 NVD
8.1 (HIGH)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

curl/libcurl versions 7.30.0 through 8.20.0 can reuse TLS connections with mismatched security settings, potentially exposing transmitted data to disclosure or modification. Organizations relying on curl-including virtually all development teams, API integrations, and infrastructure automation tools-face a data confidentiality and integrity risk. While exploitation probability is currently low, patching is straightforward and essential to prevent potential data breaches.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 91% exploitable
Prevalence
Ubiquitous
curl/libcurl ships in nearly all Linux/Unix systems and countless applications
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Curl

View all
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32206 MEDIUM POC
6.5 Jul 07

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2022-43551 HIGH POC
7.5 Dec 23

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2022-32205 MEDIUM POC
4.3 Jul 07

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re

Same weakness CWE-295 – Improper Certificate Validation

View all
CVE-2026-85102 CRITICAL POC
9.8
CVE-2015-3152 MEDIUM POC
5.9
CVE-2017-2800 CRITICAL POC
9.8
CVE-2014-1266 HIGH POC
7.4
CVE-2022-47758 CRITICAL POC
9.8
CVE-2025-68121 CRITICAL POC
10.0
CVE-2025-29331 CRITICAL POC
9.8
CVE-2025-32878 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:29017 ADVISORY https://access.redhat.com/errata/RHSA-2026:34975 ADVISORY https://curl.se/docs/CVE-2026-11564.html ADVISORY https://curl.se/docs/CVE-2026-12064.html ADVISORY https://curl.se/docs/CVE-2026-9080.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-8286 ADVISORY https://seclists.org/oss-sec/2026/q2/1012 ADVISORY https://ubuntu.com/security/notices/USN-8487-1 ADVISORY https://vuldb.com/vuln/376068 REF https://curl.se/docs/CVE-2026-8286.html REF https://curl.se/docs/CVE-2026-8286.json REF https://hackerone.com/reports/3718195

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy