CVE-2026-11564

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11564", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "state": "PUBLISHED", "assignerShortName": "curl", "dateReserved": "2026-06-08T08:22:50.089Z", "datePublished": "2026-07-03T06:12:35.251Z", "dateUpdated": "2026-09-15T06:02:39.718Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:02:39.718Z"}, "title": "Native CA trust persist", "descriptions": [{"lang": "en", "value": "libcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup.\n\nAn easy handle that first uses default native CA trust can continue trusting\nthe native platform store after the application switches that same handle to\ncustom CA material for a later transfer."}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"version": "8.17.0", "status": "affected", "versionType": "semver", "lessThan": "8.20.1"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "eefd03c572996e5de4dec4fe295ad6f103e0eefc", "status": "affected", "versionType": "git", "lessThan": "d69bfad3fa3daf5e72331f6870667607828d5891"}], "defaultStatus": "unaffected", "repo": "https://github.com/curl/curl.git"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "8.20.0", "status": "affected"}, {"version": "8.19.0", "status": "affected"}, {"version": "8.18.0", "status": "affected"}, {"version": "8.17.0", "status": "affected"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-11564.json"}, {"url": "https://curl.se/docs/CVE-2026-11564.html"}, {"url": "https://hackerone.com/reports/3788984"}], "x_osv": {"schema_version": "1.5.0", "id": "CURL-CVE-2026-11564", "aliases": ["CVE-2026-11564"], "summary": "Native CA trust persist", "modified": "2026-09-07T10:34:51.00Z", "database_specific": {"package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2026-11564.json", "www": "https://curl.se/docs/CVE-2026-11564.html", "issue": "https://hackerone.com/reports/3788984", "CWE": {"id": "CWE-295", "desc": "Improper Certificate Validation"}, "last_affected": "8.20.0", "severity": "Low"}, "published": "2026-06-24T08:00:00.00Z", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "8.17.0"}, {"fixed": "8.20.1"}]}, {"type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [{"introduced": "eefd03c572996e5de4dec4fe295ad6f103e0eefc"}, {"fixed": "d69bfad3fa3daf5e72331f6870667607828d5891"}]}], "versions": ["8.20.0", "8.19.0", "8.18.0", "8.17.0"]}], "credits": [{"name": "Filipe Casal of Trail of Bits in collaboration with OpenAI", "type": "finder"}, {"name": "Stefan Eissing", "type": "remediation developer"}], "details": "libcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup.\n\nAn easy handle that first uses default native CA trust can continue trusting\nthe native platform store after the application switches that same handle to\ncustom CA material for a later transfer."}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Certificate Validation", "cweId": "CWE-295", "type": "CWE"}]}], "credits": [{"lang": "en", "value": "Filipe Casal of Trail of Bits in collaboration with OpenAI", "type": "finder"}, {"lang": "en", "value": "Stefan Eissing", "type": "remediation developer"}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://hackerone.com/reports/3788984", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T17:09:36.356822Z", "id": "CVE-2026-11564", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T17:10:33.352Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-11564", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-06T17:09:36.356822Z"}}}], "references": [{"url": "https://hackerone.com/reports/3788984", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T17:10:28.634Z"}}], "cna": {"title": "Native CA trust persist", "x_osv": {"id": "CURL-CVE-2026-11564", "aliases": ["CVE-2026-11564"], "credits": [{"name": "Filipe Casal of Trail of Bits in collaboration with OpenAI", "type": "finder"}, {"name": "Stefan Eissing", "type": "remediation developer"}], "details": "libcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup.\n\nAn easy handle that first uses default native CA trust can continue trusting\nthe native platform store after the application switches that same handle to\ncustom CA material for a later transfer.", "summary": "Native CA trust persist", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "8.17.0"}, {"fixed": "8.20.1"}]}, {"repo": "https://github.com/curl/curl.git", "type": "GIT", "events": [{"introduced": "eefd03c572996e5de4dec4fe295ad6f103e0eefc"}, {"fixed": "d69bfad3fa3daf5e72331f6870667607828d5891"}]}], "versions": ["8.20.0", "8.19.0", "8.18.0", "8.17.0"]}], "modified": "2026-09-07T10:34:51.00Z", "published": "2026-06-24T08:00:00.00Z", "schema_version": "1.5.0", "database_specific": {"CWE": {"id": "CWE-295", "desc": "Improper Certificate Validation"}, "URL": "https://curl.se/docs/CVE-2026-11564.json", "www": "https://curl.se/docs/CVE-2026-11564.html", "issue": "https://hackerone.com/reports/3788984", "affects": "lib", "package": "curl", "severity": "Low", "last_affected": "8.20.0"}}, "credits": [{"lang": "en", "type": "finder", "value": "Filipe Casal of Trail of Bits in collaboration with OpenAI"}, {"lang": "en", "type": "remediation developer", "value": "Stefan Eissing"}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.17.0", "lessThan": "8.20.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"repo": "https://github.com/curl/curl.git", "vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "eefd03c572996e5de4dec4fe295ad6f103e0eefc", "lessThan": "d69bfad3fa3daf5e72331f6870667607828d5891", "versionType": "git"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.20.0"}, {"status": "affected", "version": "8.19.0"}, {"status": "affected", "version": "8.18.0"}, {"status": "affected", "version": "8.17.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-11564.json"}, {"url": "https://curl.se/docs/CVE-2026-11564.html"}, {"url": "https://hackerone.com/reports/3788984"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "libcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup.\n\nAn easy handle that first uses default native CA trust can continue trusting\nthe native platform store after the application switches that same handle to\ncustom CA material for a later transfer."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:02:39.718Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11564", "state": "PUBLISHED", "dateUpdated": "2026-09-15T06:02:39.718Z", "dateReserved": "2026-06-08T08:22:50.089Z", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "datePublished": "2026-07-03T06:12:35.251Z", "assignerShortName": "curl"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"lessThan": "8.20.1", "status": "affected", "version": "8.17.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "curl", "repo": "https://github.com/curl/curl.git", "vendor": "curl", "versions": [{"lessThan": "d69bfad3fa3daf5e72331f6870667607828d5891", "status": "affected", "version": "eefd03c572996e5de4dec4fe295ad6f103e0eefc", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"status": "affected", "version": "8.20.0"}, {"status": "affected", "version": "8.19.0"}, {"status": "affected", "version": "8.18.0"}, {"status": "affected", "version": "8.17.0"}]}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*", "matchCriteriaId": "B5728866-C386-4BA5-835D-792BAE02DE29", "versionEndExcluding": "8.21.0", "versionStartIncluding": "8.17.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup.\n\nAn easy handle that first uses default native CA trust can continue trusting\nthe native platform store after the application switches that same handle to\ncustom CA material for a later transfer."}], "id": "CVE-2026-11564", "lastModified": "2026-09-15T07:16:25.530", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11564", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-06T17:09:36.356822Z", "version": "2.0.3"}}]}, "published": "2026-07-03T07:16:23.790", "references": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Patch", "Vendor Advisory"], "url": "https://curl.se/docs/CVE-2026-11564.html"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Vendor Advisory"], "url": "https://curl.se/docs/CVE-2026-11564.json"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://hackerone.com/reports/3788984"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://hackerone.com/reports/3788984"}], "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-295"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2026:34975", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "rust-main-1.96.1-1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-02T00:00:00Z"}], "bugzilla": {"description": "libcurl: libcurl: Certificate validation bypass due to incorrect connection reuse", "id": "2496754", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496754"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "verified"}, "cwe": "CWE-295", "details": ["libcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup.\nAn easy handle that first uses default native CA trust can continue trusting\nthe native platform store after the application switches that same handle to\ncustom CA material for a later transfer.", "A flaw was found in curl. When libcurl reuses a connection from its connection pool, an easy handle that initially used default native Certificate Authority (CA) trust may continue to trust the native platform store. This occurs even after the application has switched that same handle to custom CA material for a subsequent transfer, potentially bypassing intended certificate validation."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-11564", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "dotnet8.0", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Affected", "package_name": "libcurl-1.dll", "product_name": "Red Hat JBoss Core Services"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Affected", "package_name": "libcurl.so", "product_name": "Red Hat JBoss Core Services"}], "public_date": "2026-07-03T06:12:35Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-11564\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-11564\nhttps://curl.se/docs/CVE-2026-11564.html\nhttps://curl.se/docs/CVE-2026-11564.json\nhttps://hackerone.com/reports/3788984"], "statement": "This Moderate flaw in curl allows a certificate validation bypass. When libcurl reuses a connection, an application that switches from default native CA trust to custom CA material on the same handle may inadvertently continue to trust the native platform store. This could lead to a bypass of intended certificate validation, as the custom CA material might not be correctly applied, potentially allowing connections to untrusted endpoints.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.20.0,8.20.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.19.0,8.19.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.18.0,8.18.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.17.0,8.17.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "curl", "source": "cna", "vendor": "curl"}, "product": "curl", "vendor": "curl"}], "created": "2026-07-03T07:30:09.154128+00:00", "updated": "2026-08-01T21:00:08.249881+00:00", "vendors": ["curl", "curl$PRODUCT$curl"]}