libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Curl
  • Curl

No data.

No data.

References
Link Providers
https://curl.se/docs/CVE-2026-8932.html cve-icon cve-icon
https://curl.se/docs/CVE-2026-8932.json cve-icon cve-icon
https://hackerone.com/reports/3733910 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-8932 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-8932 cve-icon
History

Tue, 07 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1025
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 06 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287

Mon, 06 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287

Sun, 05 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-640

Sun, 05 Jul 2026 01:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-640

Sat, 04 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-285
CWE-287

Sat, 04 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-285
CWE-287

Fri, 03 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-285
CWE-287

Fri, 03 Jul 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Curl
Curl curl
Vendors & Products Curl
Curl curl

Fri, 03 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-285
CWE-287

Fri, 03 Jul 2026 06:45:00 +0000

Type Values Removed Values Added
Description libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.
Title incomplete mTLS config matching in conn reuse
References
cve-icon MITRE

Status: PUBLISHED

Assigner: curl

Published: 2026-07-03T06:16:30.485Z

Updated: 2026-07-06T16:59:07.104Z

Reserved: 2026-05-19T08:56:58.825Z

Link: CVE-2026-8932

cve-icon Vulnrichment

Updated: 2026-07-06T16:59:01.856Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-03T06:16:30Z

Links: CVE-2026-8932 - Bugzilla