libcurl Default CA Trust Misuse Vulnerability

Executive Summary

CVE-2026-11564 is a vulnerability in libcurl where previously used connections in the connection pool retain the native CA trust settings even after an application switches to custom CA material for a later transfer.

This flaw allows libcurl to accept TLS certificates that would otherwise be rejected if custom CA settings were applied consistently.

The issue affects builds using the default "Native CA" trust store, particularly on Apple operating systems or Windows, and occurs with OpenSSL, GnuTLS, Schannel, or Rustls TLS backends.

It does not impact the curl command line tool.

The vulnerability is classified as CWE-295 (Improper Certificate Validation) with a low severity.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause libcurl to improperly validate TLS certificates by continuing to trust the native platform CA store even when an application switches to custom CA material.

As a result, connections may be established with servers presenting certificates that should have been rejected under the custom CA settings, potentially exposing the application to man-in-the-middle attacks or unauthorized access.

The impact is limited to applications using libcurl versions 8.17.0 through 8.20.0 that switch CA trust settings on the same easy handle and rely on connection reuse.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, users should upgrade libcurl to version 8.21.0 or later where the issue is fixed.

Alternatively, users can apply the official patch provided for this vulnerability.

As a workaround, avoid reusing easy handles with different CA options to prevent the native CA trust from persisting incorrectly.

Useful 0 Not Useful 0