What’s Vulnerable › Vulnerabilities

CVE-2026-8932: incomplete mTLS config matching in conn reuse

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-07-03 · updated 2026-09-15
• Weakness: CWE-305

Description

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

Affected products

• curl: from 7.7 before 8.21.0 — fixed in 8.21.0

How to fix

Upgrade to a fixed version: curl 8.21.0. Check the vendor advisory for mitigations.

References

• https://curl.se/docs/CVE-2026-8932.html
• https://curl.se/docs/CVE-2026-8932.json
• https://hackerone.com/reports/3733910
• https://hackerone.com/reports/3733910

Get alerted when CVE-2026-8932 or the next vulnerability affects your stack