Certification Validation Issues in libcurl with wolfSSL from curl

CVE-2026-82208

What is CVE-2026-82208?

The libcurl library, when utilizing the wolfSSL backend with CA caching enabled, has a flaw that allows the incorrect acceptance of certificates. A callback function specified via CURLOPT_SSL_CTX_FUNCTION, which is intended to replace the trust store, can inadvertently cause libcurl to reinstall a previously cached certificate store after the callback concludes. This situation can lead to scenarios where a certificate, deemed invalid by the new trust store selected by the callback, may still be allowed due to its presence in the cached store. This vulnerability raises significant concerns about the integrity of certificate validation processes in applications relying on libcurl, particularly those enforcing strict security measures.

References