CVE-2026-8932
HIGHDescription
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.
Is your site exposed to CVE-2026-8932?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Affected Products
| Vendor | Product |
|---|---|
| haxx | curl |
References
Frequently Asked Questions
What is CVE-2026-8932? +
How severe is CVE-2026-8932? +
What products are affected by CVE-2026-8932? +
How do I check if I'm vulnerable to CVE-2026-8932? +
Related Vulnerabilities
Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the …
libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the …
A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes …
The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the …
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public …
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication …