libcurl would reuse a previously created connection even when some mTLS config
related option had been changed that should have prohibited reuse.
libcurl keeps previously used connections in a connection pool for subsequent
transfers to reuse if one of them matches the setup. However, some TLS
settings related to client certificates were left out from the configuration
match checks, making them match too easily. In particular options related to
the private key.
References
| Link | Resource |
|---|---|
| https://curl.se/docs/CVE-2026-8932.html | Patch Vendor Advisory |
| https://curl.se/docs/CVE-2026-8932.json | Vendor Advisory |
| https://hackerone.com/reports/3733910 | Exploit Issue Tracking Third Party Advisory |
| https://hackerone.com/reports/3733910 | Exploit Issue Tracking Third Party Advisory |
Configurations
History
07 Jul 2026, 23:18
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* | |
| First Time |
Haxx curl
Haxx |
|
| References | () https://curl.se/docs/CVE-2026-8932.html - Patch, Vendor Advisory | |
| References | () https://curl.se/docs/CVE-2026-8932.json - Vendor Advisory | |
| References | () https://hackerone.com/reports/3733910 - Exploit, Issue Tracking, Third Party Advisory | |
| CWE | NVD-CWE-Other |
06 Jul 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://hackerone.com/reports/3733910 - | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
03 Jul 2026, 07:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-03 07:16
Updated : 2026-07-07 23:18
NVD link : CVE-2026-8932
Mitre link : CVE-2026-8932
CVE.ORG link : CVE-2026-8932
JSON object : View
Products Affected
haxx
- curl
CWE
