Skip to main content

curl / libcurl CVE-2026-8458

| EUVDEUVD-2026-41504 MEDIUM
Exposure of Data Element to Wrong Session (CWE-488)
2026-06-24 GHSA-88c6-6jfq-mm4q
Information Disclosure Curl Haxx
6.5
CVSS 3.1 · Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Application issues transfer to Service A
  2. Delivery
    Connection cached in libcurl pool
  3. Exploit
    Application requests transfer to different Service B
  4. Execution
    Flawed pool-matcher selects Service A connection
  5. Persist
    Transfer proceeds with wrong service context
  6. Impact
    Security controls (auth, TLS) for Service B silently bypassed

Vulnerability Assessment

Weakness
CWE
CWE-488
ASVS 5.0
V14 - Data Protection Exposure of data element to wrong session
Exploitation Conditions

Exploitation requires an application to use libcurl (not the curl command-line tool in single-transfer mode) with connection pooling active - the default - and to issue sequential or concurrent transfers targeting different services within the same session or multi-handle. The incorrect reuse only manifests when the pool-matching criteria incorrectly classify two distinct services as compatible for connection sharing. This limits exposure to programmatic libcurl consumers making multi-service requests; single-transfer curl invocations and applications that always connect to one service are not at risk. Authentication requirements for the connection itself depend on the services involved, not on the vulnerability itself. No network-level attacker position is required beyond the ability to impersonate the target service if they can cause misdirected connections.
Impact

CVSS score is not provided in the available data, but the curl project's own severity rating of LOW is the primary signal. Without an official vector, real-world risk must be assessed from context: the flaw requires a caller to make sequential transfers to distinct services within the same libcurl session, a pattern more common in programmatic libcurl consumers than typical curl command-line usage. Exploitation requires an attacker to either control the order of requests in an application or to position a malicious service where curl inadvertently reuses a connection. No EPSS data, KEV listing, or POC is referenced. EPSS is expected to be negligible given the LOW severity and absence of any exploit development activity. The primary risk is an unexpected security-context bleed (wrong authentication, wrong TLS session) rather than direct code execution or data exfiltration. Real-world priority is low for most environments; highest exposure exists in long-lived libcurl applications that concurrently or sequentially connect to multiple heterogeneous services.
Exploit ScenarioDerived

An application using libcurl in a long-lived session issues a transfer to Service A (e.g., an SFTP endpoint) followed by a transfer to Service B (e.g., an HTTPS endpoint on the same host but different port or protocol). Due to the flawed pool-matching logic, curl selects the existing connection from Service A and reuses it for the Service B transfer, potentially causing the wrong authentication material, TLS session, or protocol state to be applied. No public POC exists; an attacker exploiting this would need to influence the sequence of requests in a target application or control the 'wrong' service endpoint to capture misdirected traffic.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 24, 2026

Wrong connection reuse across different services in curl/libcurl up to 8.20.0 allows curl's connection pool to incorrectly match and reuse an existing connection when the target service differs from the one originally used to establish that connection. This is part of a coordinated batch of 19 CVEs fixed in curl 8.21.0, released June 24, 2026. No public exploit or active exploitation has been identified; the curl project rates this LOW severity, consistent with limited real-world attack surface requiring specific multi-service usage patterns.

RemediationAI

Upgrade curl and libcurl to version 8.21.0, released June 24, 2026, which resolves CVE-2026-8458 alongside 18 other security issues patched in the same coordinated release. The curl project advisory at https://curl.se/docs/CVE-2026-8458.html and the oss-security announcement at https://seclists.org/oss-sec/2026/q2/1012 are the authoritative references. For applications that cannot immediately upgrade, a compensating control is to avoid connection pool reuse across different service types by using separate easy handles or resetting the multi-handle session between transfers to distinct services - this eliminates the incorrect reuse condition at the cost of losing connection-reuse performance benefits. Applying the upstream patch and rebuilding libcurl from source is also viable if a packaged 8.21.0 is not yet available for the target platform.

Affected VersionsENISA

curl 7.85.0 ≤7.85.0
curl 7.49.0 ≤7.49.0
curl 7.52.0 ≤7.52.0
curl 7.55.1 ≤7.55.1
curl 7.51.0 ≤7.51.0
curl 7.71.1 ≤7.71.1
curl 7.70.0 ≤7.70.0
curl 7.61.0 ≤7.61.0
curl 7.55.0 ≤7.55.0
curl 7.69.1 ≤7.69.1
curl 7.57.0 ≤7.57.0
curl 7.72.0 ≤7.72.0
curl 7.87.0 ≤7.87.0
curl 7.88.1 ≤7.88.1
curl 8.10.1 ≤8.10.1
curl 7.50.3 ≤7.50.3
curl 7.53.1 ≤7.53.1
curl 7.47.0 ≤7.47.0
curl 7.68.0 ≤7.68.0
curl 7.47.1 ≤7.47.1
curl 7.83.0 ≤7.83.0
curl 7.74.0 ≤7.74.0
curl 8.2.0 ≤8.2.0
curl 7.50.0 ≤7.50.0
curl 7.62.0 ≤7.62.0
curl 7.46.0 ≤7.46.0
curl 8.11.0 ≤8.11.0
curl 8.0.0 ≤8.0.0
curl 7.71.0 ≤7.71.0
curl 7.58.0 ≤7.58.0
curl 8.10.0 ≤8.10.0
curl 7.75.0 ≤7.75.0
curl 7.50.2 ≤7.50.2
curl 7.69.0 ≤7.69.0
curl 7.83.1 ≤7.83.1
curl 7.65.2 ≤7.65.2
curl 8.12.1 ≤8.12.1
curl 7.76.0 ≤7.76.0
curl 8.9.0 ≤8.9.0
curl 8.11.1 ≤8.11.1
curl 7.78.0 ≤7.78.0
curl 7.86.0 ≤7.86.0
curl 8.12.0 ≤8.12.0
curl 8.9.1 ≤8.9.1
curl 7.53.0 ≤7.53.0
curl 8.1.0 ≤8.1.0
curl 7.76.1 ≤7.76.1
curl 7.77.0 ≤7.77.0
curl 7.64.0 ≤7.64.0
curl 8.14.1 ≤8.14.1
curl 8.16.0 ≤8.16.0
curl 7.43.0 ≤7.43.0
curl 7.49.1 ≤7.49.1
curl 7.67.0 ≤7.67.0
curl 7.64.1 ≤7.64.1
curl 8.4.0 ≤8.4.0
curl 8.0.1 ≤8.0.1
curl 7.52.1 ≤7.52.1
curl 8.7.0 ≤8.7.0
curl 8.15.0 ≤8.15.0
curl 7.66.0 ≤7.66.0
curl 7.82.0 ≤7.82.0
curl 8.1.2 ≤8.1.2
curl 7.63.0 ≤7.63.0
curl 7.73.0 ≤7.73.0
curl 8.6.0 ≤8.6.0
curl 8.7.1 ≤8.7.1
curl 7.65.1 ≤7.65.1
curl 7.56.0 ≤7.56.0
curl 7.60.0 ≤7.60.0
curl 8.1.1 ≤8.1.1
curl 7.45.0 ≤7.45.0
curl 7.54.1 ≤7.54.1
curl 8.13.0 ≤8.13.0
curl 7.79.1 ≤7.79.1
curl 7.61.1 ≤7.61.1
curl 8.2.1 ≤8.2.1
curl 8.18.0 ≤8.18.0
curl 7.54.0 ≤7.54.0
curl 7.59.0 ≤7.59.0
curl 7.50.1 ≤7.50.1
curl 8.20.0 ≤8.20.0
curl 7.65.0 ≤7.65.0
curl 7.79.0 ≤7.79.0
curl 7.88.0 ≤7.88.0
curl 8.8.0 ≤8.8.0
curl 7.65.3 ≤7.65.3
curl 8.3.0 ≤8.3.0
curl 8.14.0 ≤8.14.0
curl 7.48.0 ≤7.48.0
curl 7.84.0 ≤7.84.0
curl 8.17.0 ≤8.17.0
curl 7.56.1 ≤7.56.1
curl 7.80.0 ≤7.80.0
curl 8.19.0 ≤8.19.0
curl 7.44.0 ≤7.44.0
curl 8.5.0 ≤8.5.0
curl 7.81.0 ≤7.81.0

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

curl maintains an internal connection pool (multi-handle connection cache) to reuse established TCP/TLS connections for subsequent transfers to the same host, improving performance. CVE-2026-8458 represents a logic flaw in the connection pool matching algorithm: when an application issues requests to different services - distinguished by protocol, port, or service type - curl incorrectly identifies a pooled connection established for one service as eligible for reuse by a transfer targeting a different service. Related sibling CVEs in the same release (CVE-2026-8286 for wrong STARTTLS reuse, CVE-2026-8932 for incomplete mTLS config matching in conn reuse) confirm a pattern of curl connection-cache selection bugs in the 8.17-8.20 era. The likely CWE class is CWE-706 (Use of Incorrectly-Resolved Name or Reference) or closely related state-management defects in pool key comparison. The flaw affects libcurl consumers; command-line tool impact depends on multi-transfer usage patterns.

Know when Curl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
vuln.today AI 4.8 MEDIUM

Network vector as curl operates over network; AC:H because wrong-reuse requires specific multi-service session conditions; C:L/I:L for potential context bleed, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE 4.2 MEDIUM
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Red Hat 8.1 HIGH

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

1
CVSS changed
Jul 06, 2026 - 18:22 NVD
6.5 (MEDIUM)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Threat Intelligence Overview

EPSS Score
0.2%
Top 89% exploitable
Prevalence
Ubiquitous
libcurl embedded in virtually every Linux distro, macOS, Windows, and countless apps
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact· derived
High

Priority Score

32
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Curl

View all
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32206 MEDIUM POC
6.5 Jul 07

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2022-43551 HIGH POC
7.5 Dec 23

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2022-32205 MEDIUM POC
4.3 Jul 07

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re

Same weakness CWE-488 – Exposure of Data Element to Wrong Session

View all
CVE-2024-38367 CRITICAL POC
9.6
CVE-2024-27935 HIGH POC
8.3
CVE-2026-88017 HIGH POC
7.3
CVE-2026-16498 CRITICAL
10.0
CVE-2026-16326 CRITICAL
10.0
CVE-2026-19931 CRITICAL POC
9.8
CVE-2024-27455 CRITICAL
9.1
CVE-2026-71850 MEDIUM POC
4.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:29017 ADVISORY https://access.redhat.com/errata/RHSA-2026:34975 ADVISORY https://curl.se/docs/CVE-2026-11564.html ADVISORY https://curl.se/docs/CVE-2026-12064.html ADVISORY https://curl.se/docs/CVE-2026-9080.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-8458 ADVISORY https://seclists.org/oss-sec/2026/q2/1012 ADVISORY https://ubuntu.com/security/notices/USN-8487-1 ADVISORY https://vuldb.com/vuln/376069 REF https://curl.se/docs/CVE-2026-8458.html REF https://curl.se/docs/CVE-2026-8458.json REF https://hackerone.com/reports/3721183

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy