Skip to main content

libcurl EUVDEUVD-2026-72169

| CVE-2026-80231 HIGH
Exposure of Data Element to Wrong Session (CWE-488)
2026-09-02 GHSA-r8j3-cwj5-4j73
Red Hat Curl Haxx
High
Disputed · 7.5 Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain MITM network position between client and server
  2. Delivery
    Target application makes mixed CURLSSLOPT_NATIVE_CA requests to same hostname
  3. Exploit
    Libcurl reuses existing connection ignoring CA setting mismatch
  4. Execution
    Second request validated with wrong CA trust context
  5. Persist
    Present cert invalid under native CA but valid under bundled CA
  6. Impact
    Intercept or tamper with HTTPS session

Vulnerability Assessment

Weakness
CWE
CWE-488
ASVS 5.0
V14 - Data Protection Exposure of data element to wrong session
Exploitation Conditions

Exploitation requires an application to issue HTTPS requests to the same hostname within a shared libcurl connection pool where some requests use CURLSSLOPT_NATIVE_CA and others do not - a non-default, uncommon configuration pattern. Applications that apply a uniform CA configuration across all connections are not affected. An attacker must also hold a MITM network position between the libcurl client and the target server to leverage any resulting CA validation bypass, and must possess a certificate trusted by the permissive (non-native) CA context but not the intended native one. Applications using CURLOPT_FRESH_CONNECT or separate connection pools per CA configuration are not affected.
Impact

The vendor-assigned CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) assigns availability-only impact, which is in tension with the typical security concern of TLS CA validation bypass - a CA mismatch normally implies integrity or confidentiality risk rather than pure availability. The A:H assignment may reflect scenarios where the wrong CA configuration causes connection establishment failures rather than silent bypass (e.g., native CA validation is stricter than the bundled CA bundle, and the wrong reuse causes otherwise-valid connections to fail). The 'Information Disclosure' tag from the input data conflicts with the CVSS C:N rating and should be treated as mislabeled. EPSS at 0.21% reflects low real-world exploitation activity; no KEV listing confirms this is not currently actively exploited. The practical exploitability ceiling is significantly lower than AC:L implies, because the bug only manifests when a single application mixes CURLSSLOPT_NATIVE_CA and non-native-CA connections to the same hostname within a shared pool - an uncommon deployment pattern. Applications with uniform CA configuration are not affected.
Exploit ScenarioDerived

An application uses a shared libcurl connection pool to make HTTPS requests to the same hostname - first without CURLSSLOPT_NATIVE_CA (using the bundled CA bundle), then with it enabled (expecting the OS native trust store). Libcurl reuses the first connection for the second request, applying the non-native CA validation context instead of the native one. An attacker with MITM network positioning presents a certificate trusted by the bundled CA bundle but not by the native OS store, successfully intercepting the second request's traffic that was intended to be validated against the stricter native store.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Sep 08, 2026

Connection pool mismanagement in libcurl silently reuses HTTPS connections across requests that differ in their CURLSSLOPT_NATIVE_CA (Native CA Store) SSL option, affecting all curl releases from 7.71.0 through 8.21.0. When an application uses a shared connection pool to the same hostname with mixed native CA settings, libcurl fails to distinguish connections by their CA trust configuration, potentially applying the wrong certificate authority validation to a subsequent request. No public exploit code exists and EPSS sits at 0.21% (12th percentile), indicating low active exploitation probability, though the vulnerability's broad version footprint - spanning several years of releases - makes it relevant wherever libcurl is deployed with mixed native CA configurations.

Earlier versions of this analysis (2)
v2 Sep 08, 2026 - 19:44 cvss changed CVSS 7.5

Connection state confusion in libcurl causes the library to incorrectly reuse an existing HTTPS connection established without the CURLSSLOPT_NATIVE_CA flag for a subsequent request that explicitly requires native OS certificate store validation, or vice versa. Affected versions span from 7.71.0 (when CURLSSLOPT_NATIVE_CA was introduced) through 8.21.0, as confirmed by the curl project advisory and EUVD listing. An attacker positioned to influence which connection is pooled and reused - or a server presenting a certificate trusted only by one CA store - can either cause the wrong certificate validation path to be silently applied or trigger connection failure, depending on the direction of the mismatch. No public exploit code exists and EPSS exploitation probability is extremely low at 0.21%.

v1 Sep 02, 2026 - 12:16

Connection reuse logic in curl's native CA store code path fails to properly isolate connections that were established under differing CA verification contexts, potentially allowing a subsequent request to reuse a connection whose native-CA validation would not have succeeded independently. All curl and libcurl users on platforms using the OS-native certificate store (Windows CertStore, macOS Keychain, etc.) rather than curl's bundled CA bundle are affected in versions up to and including 8.21.0. An attacker in a position to influence connection reuse - such as a MITM or a server that shares a connection pool - could bypass native CA certificate validation for a subsequent request. No public exploit has been identified at time of analysis, and no KEV listing is present.

RemediationAI

The curl project has published advisory https://curl.se/docs/CVE-2026-80231.html documenting the fix. The reference to https://curl.se/docs/vuln-8.21.0.html confirms that 8.21.0 is still vulnerable; the fix is expected in the next release beyond 8.21.0 (exact patched version not independently confirmed from the provided references - consult curl.se for the definitive fix version before upgrading). As an immediate compensating control, applications that mix CURLSSLOPT_NATIVE_CA and non-native-CA connections can set CURLOPT_FRESH_CONNECT to disable connection reuse, guaranteeing a new TLS handshake with the correct CA configuration per request; the trade-off is added latency and TLS negotiation overhead per connection. Alternatively, using separate CURLM multi-handles with distinct connection pools for native-CA and non-native-CA requests eliminates the pool collision without sacrificing reuse entirely.

Affected VersionsENISA

curl 7.71.0 ≤7.71.0
curl 8.1.0 ≤8.1.0
curl 7.79.1 ≤7.79.1
curl 7.82.0 ≤7.82.0
curl 8.18.0 ≤8.18.0
curl 8.17.0 ≤8.17.0
curl 7.85.0 ≤7.85.0
curl 8.0.0 ≤8.0.0
curl 8.21.0 ≤8.21.0
curl 7.76.1 ≤7.76.1
curl 7.84.0 ≤7.84.0
curl 8.20.0 ≤8.20.0
curl 7.73.0 ≤7.73.0
curl 8.16.0 ≤8.16.0
curl 8.10.1 ≤8.10.1
curl 8.11.1 ≤8.11.1
curl 8.12.0 ≤8.12.0
curl 8.9.1 ≤8.9.1
curl 7.81.0 ≤7.81.0
curl 7.78.0 ≤7.78.0
curl 8.14.0 ≤8.14.0
curl 8.1.2 ≤8.1.2
curl 8.2.1 ≤8.2.1
curl 7.88.1 ≤7.88.1
curl 8.1.1 ≤8.1.1
curl 8.2.0 ≤8.2.0
curl 8.8.0 ≤8.8.0
curl 7.72.0 ≤7.72.0
curl 8.10.0 ≤8.10.0
curl 7.83.1 ≤7.83.1
curl 7.74.0 ≤7.74.0
curl 8.7.0 ≤8.7.0
curl 7.88.0 ≤7.88.0
curl 8.11.0 ≤8.11.0
curl 7.71.1 ≤7.71.1
curl 8.4.0 ≤8.4.0
curl 8.19.0 ≤8.19.0
curl 8.5.0 ≤8.5.0
curl 8.14.1 ≤8.14.1
curl 7.83.0 ≤7.83.0
curl 8.3.0 ≤8.3.0
curl 7.86.0 ≤7.86.0
curl 8.0.1 ≤8.0.1
curl 8.6.0 ≤8.6.0
curl 7.87.0 ≤7.87.0
curl 7.79.0 ≤7.79.0
curl 7.75.0 ≤7.75.0
curl 7.77.0 ≤7.77.0
curl 8.7.1 ≤8.7.1
curl 7.80.0 ≤7.80.0
curl 8.12.1 ≤8.12.1
curl 8.13.0 ≤8.13.0
curl 7.76.0 ≤7.76.0
curl 8.9.0 ≤8.9.0
curl 8.15.0 ≤8.15.0

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libcurl (the C library underlying the curl command-line tool) maintains an internal connection pool that reuses established TLS connections to the same hostname to reduce latency. The CURLSSLOPT_NATIVE_CA flag (set via CURLOPT_SSL_OPTIONS) instructs libcurl to use the platform's native CA certificate store - Windows Certificate Store, macOS Keychain, or NSS/GnuTLS system stores - instead of curl's bundled CA bundle. The connection pool's connection-matching logic incorrectly omits this flag when evaluating whether an existing connection can be reused, treating connections as equivalent regardless of their CA trust configuration. CWE-488 (Exposure of Data Element to Wrong Session) precisely describes the root cause: the CA trust context established for one connection session is exposed to a new session that requested a different trust context. The affected version range begins at 7.71.0, which aligns with when CURLSSLOPT_NATIVE_CA support was added to libcurl, and extends through 8.21.0 as documented in EUVD-2026-72169.

Know when Curl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (CNA) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 6.5 HIGH

MITM position required to exploit TLS CA bypass (AC:H); integrity is the primary risk from wrong CA trust application (I:H); no inherent availability impact from the bypass path.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE 3.1 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Red Hat 3.7 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Updated
Sep 08, 2026 - 19:47 vuln.today
v3 - CVSS changed
Analysis Updated
Sep 08, 2026 - 19:44 vuln.today
v2 - CVSS changed
CVSS changed
Sep 08, 2026 - 19:23 NVD
7.5 (HIGH)
CVE Published
Sep 02, 2026 - 10:57 oss-security
HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

Organizations using libcurl versions 7.71.0-8.21.0 risk certificate validation bypass on HTTPS connections due to improper connection reuse, potentially allowing attackers to intercept sensitive API calls and data transfers when applications use mixed certificate authority configurations. While active exploitation probability is low, the wide deployment of affected versions and potential for data compromise warrant business attention.

Business Impact: Medium
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Separate curl connection pools or handles by native CA configuration to prevent cross-request reuse; (2) Use CURLOPT_FORBID_REUSE to disable connection pooling for mixed-CA scenarios; (3) Audit application code to enforce consistent native CA store settings per hostname; (4) Deploy certificate pinning or proxy-level MITM detection to catch potential trust violations; (5) Subscribe to libcurl security advisories and mailing list for patch availability notifications.

Threat Intelligence Overview

EPSS Score
0.2%
Top 88% exploitable
Prevalence
High
core HTTP transfer library embedded across Linux distros, cloud tooling, and embedded systems
Data Quality
6 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Medium

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

More in Curl

View all
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32206 MEDIUM POC
6.5 Jul 07

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2022-43551 HIGH POC
7.5 Dec 23

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2022-32205 MEDIUM POC
4.3 Jul 07

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re

Same weakness CWE-488 – Exposure of Data Element to Wrong Session

View all
CVE-2024-38367 CRITICAL POC
9.6
CVE-2024-27935 HIGH POC
8.3
CVE-2026-88017 HIGH POC
7.3
CVE-2026-16498 CRITICAL
10.0
CVE-2026-16326 CRITICAL
10.0
CVE-2026-19931 CRITICAL POC
9.8
CVE-2024-27455 CRITICAL
9.1
CVE-2026-71850 MEDIUM POC
4.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP6-CHOST-BYOS Not-Affected
SLES15-SP6-CHOST-BYOS-Aliyun Not-Affected
SLES15-SP6-CHOST-BYOS-Azure Not-Affected
SLES15-SP6-CHOST-BYOS-EC2 Not-Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:63161 ADVISORY https://curl.se/docs/CVE-2026-80256.html ADVISORY https://curl.se/docs/vuln-8.21.0.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-80231 ADVISORY https://rock-solid.curl.dev ADVISORY https://seclists.org/oss-sec/2026/q3/637 ADVISORY https://vuldb.com/vuln/399472 REF https://curl.se/docs/CVE-2026-80231.html REF https://curl.se/docs/CVE-2026-80231.json REF https://hackerone.com/reports/3969368

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy