curl CVE-2026-9545

Exploitation requires all of the following to hold simultaneously: the libcurl-based application must have set the CURLSSLOPT_EARLYDATA bit in CURLOPT_SSL_OPTIONS (TLS 0-RTT is OFF by default); CURLOPT_SSL_SESSIONID_CACHE must remain enabled (the default) so a resumable session exists; and a prior successful transfer to the host must have populated the session cache. The attacker must then achieve an active man-in-the-middle position and impersonate the original hostname on the subsequent connection with an invalid or absent certificate. Limiting factors: the non-default early-data opt-in means most curl deployments are unaffected; the need for an active MITM (not an off-path remote attacker) substantially raises real-world difficulty despite the AV:N/PR:N vector; and only the specific request bytes sent as early data are exposed (I:N/A:N - no integrity or availability impact).

The published CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H) treats this as trivially exploitable network confidentiality loss, but that score understates the real preconditions: exploitation requires (1) an application that explicitly enabled TLS early data - a non-default setting - and (2) an attacker already positioned as an active man-in-the-middle able to impersonate the target host. Those are exactly the conditions AC:L fails to capture, so the low-complexity rating is optimistic; a more honest assessment raises attack complexity. The signals are internally consistent on low urgency: EPSS is only 0.13% (3rd percentile), the CVE is NOT in CISA KEV, and no POC is referenced, so no public exploit identified at time of analysis. This is a genuine but conditional confidentiality flaw, not a mass-exploitation priority; patch it in the normal cycle, prioritizing systems that opt into early data. State the discrepancy explicitly: CVSS implies an easy off-path remote attack, but the description's 'impostor machine' and 'early data enabled' language means a specialized MITM and non-default config are required - verify your own curl usage before rating urgency.

An application built on libcurl enables TLS early data for performance and makes repeated requests to a host (e.g., an API endpoint) carrying authentication headers or cookies. An attacker with a network position - via ARP/DNS spoofing, rogue Wi-Fi, or route hijack - impersonates that host on the client's second connection without a valid certificate; libcurl resumes the cached session and transmits the request's 0-RTT bytes to the impostor before the certificate check aborts, leaking the sensitive headers. No POC is referenced in the available intelligence.