Connection Pool Reuse Flaw in libcurl Affects Multiple Products
CVE-2026-8932
Key Information:
Badges
What is CVE-2026-8932?
A vulnerability in libcurl arises from its connection pooling mechanism, where previously established connections can be reused despite changes to mTLS configuration settings. This flaw occurs because certain TLS parameters associated with client certificates are not adequately checked during the reuse process. Specifically, alterations related to the private key are not taken into account, potentially allowing unauthorized access or data leakage during secure connections. Users of libcurl should review their implementations to safeguard client certificates against inadvertent connection reuse.
Affected Version(s)
curl 7.7.0 < 8.14.2
curl 8.15.0 < 8.16.1
curl 8.17.0 < 8.20.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
It Security NewsCVE-2026-893225-Year-Old Vulnerability in cURL Used by 30 Billion Devices Finally Patched - IT Security News
A critical security flaw lurking in curl for over 25 years has been patched, as part of a record-breaking security release that fixed 18 CVEs, the most ever issued in a single curl version. The vulnerability, CVE-2026-8932, was first shipped…Read more →
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
- 📰
First article discovered by It Security News
Vulnerability Reserved