Connection Reuse Vulnerability in cURL
CVE-2026-107929
Currently unrated
What is CVE-2026-107929?
A vulnerability exists in cURL where the CURLOPT_INTERFACE option, when set with specific prefixes such as if!, host!, or ifhost!, can lead to connection reuse. This means that subsequent transfers, which specify a different source address, can unintentionally reuse an existing connection initialized by a previous transfer. This behavior may result in the exposure of data to unintended recipients, creating potential privacy and security risks.
Affected Version(s)
curl 8.22.0
curl 8.21.0
curl 8.20.0