CVE-2026-80231
Modified Modified - Updated After Analysis

libcurl HTTPS Connection Reuse with Native CA Store Misconfiguration

Publication date: 2026-09-06

Last updated on: 2026-09-15

Assigner: curl

Description
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-15
Generated
2026-09-28
AI Q&A
2026-09-06
EPSS Evaluated
2026-09-27
NVD
CVE-2026-80231
EUVD
EUVD-2026-72169

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
haxx curl From 7.71.0 (inc) to 8.22.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-488 The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in libcurl causes it to reuse an existing HTTPS connection for a hostname even when the Native CA Store setting differs from when the connection was created. This only affects Windows and macOS and impacts the curl command line tool. It was introduced in curl 7.71.0 and fixed in 8.22.0.

Detection Guidance

To detect this vulnerability, check the version of curl/libcurl installed on your system. Run 'curl --version' to see if it falls within the affected range (7.71.0 to 8.21.0). If so, the system is potentially vulnerable.

Impact Analysis

This flaw could expose data to the wrong session due to improper handling of CA store configurations. It may lead to security risks if sensitive data is transmitted over an unintended connection. Users should upgrade to curl 8.22.0 or apply a patch to mitigate the issue.

Compliance Impact

This vulnerability could potentially lead to data exposure by reusing HTTPS connections with incorrect CA store settings, which may violate data protection requirements under GDPR or HIPAA if sensitive data is transmitted insecurely.

Mitigation Strategies

Upgrade curl to version 8.22.0 or later. Alternatively, apply a patch or enable CURLOPT_FORBID_REUSE for transfers using the native CA store.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80231. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart