CVE-2026-8286 Details
Description
A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.
A vulnerability in curl exists where data transfers using STARTTLS to upgrade the connection may improperly reuse an existing live connection, despite mismatched TLS configurations. This issue affects curl versions 7.30.0 prior to 8.21.0, including the curl command line tool. The vulnerability arises because the validation logic meant to ensure consistent TLS settings between transfers is not applied when upgrading connections with STARTTLS for protocols like IMAP, POP3, SMTP, FTP, and LDAP. As a result, an attacker could potentially exploit this flaw to manipulate the TLS session verification process, leading to improper certificate validation.
Users are advised to upgrade to curl and libcurl version 8.21.0, which addresses this vulnerability. Alternatively, the patch can be applied and libcurl rebuilt. If neither option is feasible, avoid using clear-text transfers with IMAP, POP3, SMTP, FTP, or LDAP.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackerone.com/reports/3718195 | CISA-ADP | ExploitIssue TrackingThird Party Advisory |
| https://curl.se/docs/CVE-2026-8286.html | curl | PatchVendor Advisory |
| https://curl.se/docs/CVE-2026-8286.json | curl | Vendor Advisory |
| https://hackerone.com/reports/3718195 | curl | ExploitIssue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
| CWE-295 | Improper Certificate Validation | curl |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 7.30.0, < 8.21.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | curl |
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 3, 2026 | New CVE Received | curl |