CVE-2026-8932

CVE Enrichment

CVSS: 7.5 HIGH
EPSS: 0.40%
EPSS Percentile: 33.79%
CISA KEV: Not listed

Description

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: 2499f714-1537-4658-8207-48ae4bb9eae9
Published: 03-Jul-2026 14:16
Last Modified: 15-Sep-2026 14:16
EPSS Date: 2026-10-29
CWE: CWE-305

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:N /
                            I:H /
                            A:N

Affected Products / Versions

haxx / curl
Version / affected range: * · from (inclusive) 7.7 · before (exclusive) 8.21.0
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

References

Last enrichment sync: 30-Oct-2026 11:19
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

a connection, credential, or host identity is still valid.” One of the notable vulnerabilities is CVE-2026-8932, which allows the library to “reuse a previously created connection even when some mTLS config-related ThreatsDay Roundup: Smart TV Proxyware, curl and Hoppscotch Flaws, and Malware Campaigns
Tracked as CVE-2026-8932, it is described as an mTLS connection reuse and could lead to authentication bypass. curl Update Patches 18 Vulnerabilities, Including 25-Year-Old Potential Authentication Bypass

CVE (6)

Malware (8)

People (2)

Threat Actors (9)

Vendors (11)

Products (10)

Industries (2)

Countries (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.