CVE-2026-8932

incomplete mTLS config matching in conn reuse

Published Jul 3, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

libcurl would reuse a previously created connection even when some mTLS config
related option had been changed that should have prohibited reuse.

libcurl keeps previously used connections in a connection pool for subsequent
transfers to reuse if one of them matches the setup. However, some TLS
settings related to client certificates were left out from the configuration
match checks, making them match too easily. In particular options related to
the private key.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

curl

unaffected

Version	Status	Constraints
`7.7.0`	affected	< 8.14.2
`8.15.0`	affected	< 8.16.1
`8.17.0`	affected	< 8.20.1

curl

unaffected

Version	Status	Constraints
`a1d6ad26100bc493c7b04f1301b1634b7f5aa8b4`	affected	< 7541ae569d82fb308a5e2d94916027da4fa3ba3e

curl

unaffected

Version	Status	Constraints
`8.20.0`	affected	—
`8.19.0`	affected	—
`8.18.0`	affected	—
`8.17.0`	affected	—
`8.16.0`	affected	—
`8.15.0`	affected	—
`8.14.1`	affected	—
`8.14.0`	affected	—
`8.13.0`	affected	—
`8.12.1`	affected	—
`8.12.0`	affected	—
`8.11.1`	affected	—
`8.11.0`	affected	—
`8.10.1`	affected	—
`8.10.0`	affected	—
`8.9.1`	affected	—
`8.9.0`	affected	—
`8.8.0`	affected	—
`8.7.1`	affected	—
`8.7.0`	affected	—
`8.6.0`	affected	—
`8.5.0`	affected	—
`8.4.0`	affected	—
`8.3.0`	affected	—
`8.2.1`	affected	—
`8.2.0`	affected	—
`8.1.2`	affected	—
`8.1.1`	affected	—
`8.1.0`	affected	—
`8.0.1`	affected	—
`8.0.0`	affected	—
`7.88.1`	affected	—
`7.88.0`	affected	—
`7.87.0`	affected	—
`7.86.0`	affected	—
`7.85.0`	affected	—
`7.84.0`	affected	—
`7.83.1`	affected	—
`7.83.0`	affected	—
`7.82.0`	affected	—
`7.81.0`	affected	—
`7.80.0`	affected	—
`7.79.1`	affected	—
`7.79.0`	affected	—
`7.78.0`	affected	—
`7.77.0`	affected	—
`7.76.1`	affected	—
`7.76.0`	affected	—
`7.75.0`	affected	—
`7.74.0`	affected	—
`7.73.0`	affected	—
`7.72.0`	affected	—
`7.71.1`	affected	—
`7.71.0`	affected	—
`7.70.0`	affected	—
`7.69.1`	affected	—
`7.69.0`	affected	—
`7.68.0`	affected	—
`7.67.0`	affected	—
`7.66.0`	affected	—
`7.65.3`	affected	—
`7.65.2`	affected	—
`7.65.1`	affected	—
`7.65.0`	affected	—
`7.64.1`	affected	—
`7.64.0`	affected	—
`7.63.0`	affected	—
`7.62.0`	affected	—
`7.61.1`	affected	—
`7.61.0`	affected	—
`7.60.0`	affected	—
`7.59.0`	affected	—
`7.58.0`	affected	—
`7.57.0`	affected	—
`7.56.1`	affected	—
`7.56.0`	affected	—
`7.55.1`	affected	—
`7.55.0`	affected	—
`7.54.1`	affected	—
`7.54.0`	affected	—
`7.53.1`	affected	—
`7.53.0`	affected	—
`7.52.1`	affected	—
`7.52.0`	affected	—
`7.51.0`	affected	—
`7.50.3`	affected	—
`7.50.2`	affected	—
`7.50.1`	affected	—
`7.50.0`	affected	—
`7.49.1`	affected	—
`7.49.0`	affected	—
`7.48.0`	affected	—
`7.47.1`	affected	—
`7.47.0`	affected	—
`7.46.0`	affected	—
`7.45.0`	affected	—
`7.44.0`	affected	—
`7.43.0`	affected	—
`7.42.1`	affected	—
`7.42.0`	affected	—
`7.41.0`	affected	—
`7.40.0`	affected	—
`7.39.0`	affected	—
`7.38.0`	affected	—
`7.37.1`	affected	—
`7.37.0`	affected	—
`7.36.0`	affected	—
`7.35.0`	affected	—
`7.34.0`	affected	—
`7.33.0`	affected	—
`7.32.0`	affected	—
`7.31.0`	affected	—
`7.30.0`	affected	—
`7.29.0`	affected	—
`7.28.1`	affected	—
`7.28.0`	affected	—
`7.27.0`	affected	—
`7.26.0`	affected	—
`7.25.0`	affected	—
`7.24.0`	affected	—
`7.23.1`	affected	—
`7.23.0`	affected	—
`7.22.0`	affected	—
`7.21.7`	affected	—
`7.21.6`	affected	—
`7.21.5`	affected	—
`7.21.4`	affected	—
`7.21.3`	affected	—
`7.21.2`	affected	—
`7.21.1`	affected	—
`7.21.0`	affected	—
`7.20.1`	affected	—
`7.20.0`	affected	—
`7.19.7`	affected	—
`7.19.6`	affected	—
`7.19.5`	affected	—
`7.19.4`	affected	—
`7.19.3`	affected	—
`7.19.2`	affected	—
`7.19.1`	affected	—
`7.19.0`	affected	—
`7.18.2`	affected	—
`7.18.1`	affected	—
`7.18.0`	affected	—
`7.17.1`	affected	—
`7.17.0`	affected	—
`7.16.4`	affected	—
`7.16.3`	affected	—
`7.16.2`	affected	—
`7.16.1`	affected	—
`7.16.0`	affected	—
`7.15.5`	affected	—
`7.15.4`	affected	—
`7.15.3`	affected	—
`7.15.2`	affected	—
`7.15.1`	affected	—
`7.15.0`	affected	—
`7.14.1`	affected	—
`7.14.0`	affected	—
`7.13.2`	affected	—
`7.13.1`	affected	—
`7.13.0`	affected	—
`7.12.3`	affected	—
`7.12.2`	affected	—
`7.12.1`	affected	—
`7.12.0`	affected	—
`7.11.2`	affected	—
`7.11.1`	affected	—
`7.11.0`	affected	—
`7.10.8`	affected	—
`7.10.7`	affected	—
`7.10.6`	affected	—
`7.10.5`	affected	—
`7.10.4`	affected	—
`7.10.3`	affected	—
`7.10.2`	affected	—
`7.10.1`	affected	—
`7.10`	affected	—
`7.9.8`	affected	—
`7.9.7`	affected	—
`7.9.6`	affected	—
`7.9.5`	affected	—
`7.9.4`	affected	—
`7.9.3`	affected	—
`7.9.2`	affected	—
`7.9.1`	affected	—
`7.9`	affected	—
`7.8.1`	affected	—
`7.8`	affected	—
`7.7.3`	affected	—
`7.7.2`	affected	—
`7.7.1`	affected	—
`7.7`	affected	—

Configuration 1 [-]

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Curl

Version	Status	Scheme	Platform
`[7.7.0,8.20.0]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8670-1	curl vulnerability
Ubuntu USN	USN-8670-2	curl vulnerability
Ubuntu USN	USN-8670-3	curl vulnerability

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.396% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://curl.se/docs/CVE-2026-8932.html
https://curl.se/docs/CVE-2026-8932.json
https://hackerone.com/reports/3733910
https://nvd.nist.gov/vuln/detail/CVE-2026-8932
https://www.cve.org/CVERecord?id=CVE-2026-8932

History

Sep 15, 2026 6:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-305

Jul 7, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-1025
References		https://nvd.nist.gov/vuln/detail/CVE-2026-8932 https://www.cve.org/CVERecord?id=CVE-2026-8932
Metrics	threat_severity `None`	threat_severity `Important`

Jul 6, 2026 10:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-287

Jul 6, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 6, 2026 1:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-287

Jul 5, 2026 8:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-20 CWE-640

Jul 5, 2026 1:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-20 CWE-640

Jul 4, 2026 8:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-285 CWE-287

Jul 4, 2026 1:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-285 CWE-287

Jul 3, 2026 9:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-285 CWE-287

Jul 3, 2026 11:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Curl Curl curl
Vendors & Products		Curl Curl curl

Jul 3, 2026 10:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-285 CWE-287

Jul 3, 2026 6:45 AM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.
Title		incomplete mTLS config matching in conn reuse
References		https://curl.se/docs/CVE-2026-8932.html https://curl.se/docs/CVE-2026-8932.json https://hackerone.com/reports/3733910