CVE-2026-8932 Details
Description
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.
A vulnerability exists in libcurl versions 7.7 prior to 8.21.0, allowing for improper handling of mTLS configuration during connection reuse. When certain mTLS-related options were changed, libcurl still reused connections from a pool, leading to potential authentication issues. This flaw arises because some TLS settings related to client certificates, particularly those involving private keys, were not adequately considered in the configuration match checks. As a result, connections could be reused even when they should not have been, allowing one handle to inherit the authenticated identity of another on the same connection.
Users are advised to upgrade curl and libcurl to version 8.21.0 or later. Alternatively, the patch can be applied to the current version and the application rebuilt.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackerone.com/reports/3733910 | CISA-ADP | ExploitIssue TrackingThird Party Advisory |
| https://curl.se/docs/CVE-2026-8932.html | curl | PatchVendor Advisory |
| https://curl.se/docs/CVE-2026-8932.json | curl | Vendor Advisory |
| https://hackerone.com/reports/3733910 | curl | ExploitIssue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-Other | Weakness Not in a Standard CWE Category | [email protected] |
| CWE-305 | Authentication Bypass by Primary Weakness | curl |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 7.7, < 8.21.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | curl |
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 3, 2026 | New CVE Received | curl |