CVE-2026-11564: Native CA trust persist

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-07-03 · updated 2026-09-15
Weakness: CWE-295

Description

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Affected products

curl: from 8.17.0 before 8.21.0 — fixed in 8.21.0

How to fix

Upgrade to a fixed version: curl 8.21.0. Check the vendor advisory for mitigations.

References

https://curl.se/docs/CVE-2026-11564.html
https://curl.se/docs/CVE-2026-11564.json
https://hackerone.com/reports/3788984
https://hackerone.com/reports/3788984

Get alerted when CVE-2026-11564 or the next vulnerability affects your stack