CVEvulnerability
CVE-2026-11564
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2026-07-03
- Last modified
- 2026-09-15
- Assigner
- 2499f714-1537-4658-8207-48ae4bb9eae9
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-295
Description
libcurl keeps previously used connections in a connection pool for subsequent
transfers to reuse if one of them matches the setup.
An easy handle that first uses default native CA trust can continue trusting
the native platform store after the application switches that same handle to
custom CA material for a later transfer.
Affected configurations
• haxx curl (>= 8.17.0 < 8.21.0)
Related
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- https://curl.se/docs/CVE-2026-11564.html Patch, Vendor Advisory
- https://curl.se/docs/CVE-2026-11564.json Vendor Advisory
- https://hackerone.com/reports/3788984 Exploit, Issue Tracking, Third Party Advisory
- https://hackerone.com/reports/3788984 Exploit, Issue Tracking, Third Party Advisory