libcurl Certificate Trust Store Reinstallation Vulnerability with wolfSSL Backend

Executive Summary

CVE-2026-82208 is a vulnerability in curl versions 8.9.1 to 8.21.0 when using the wolfSSL TLS backend. It occurs when CA caching is enabled and a custom SSL context callback replaces the trust store. After the callback runs, libcurl may silently reinstall the cached CA store, overriding the callback's selection. This causes certificates trusted by the cached store but rejected by the callback-selected store to be incorrectly accepted.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses curl versions 8.9.1 to 8.21.0 with the wolfSSL backend and CA caching enabled. Run 'curl --version' to verify the version. If using a vulnerable version, inspect applications using CURLOPT_SSL_CTX_FUNCTION with wolfSSL.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to bypass certificate validation if they can trick a system into trusting a malicious certificate via the cached store. Applications using CURLOPT_SSL_CTX_FUNCTION with wolfSSL and CA caching enabled may accept invalid certificates, potentially leading to man-in-the-middle attacks or unauthorized data access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate compliance requirements that mandate strict certificate validation, such as GDPR's data protection measures or HIPAA's security controls for data transmission. Accepting invalid certificates could lead to unauthorized access to sensitive data, resulting in non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade curl to version 8.22.0 or later. If upgrading is not possible, avoid using CURLOPT_SSL_CTX_FUNCTION with the wolfSSL backend or disable CA caching in your configuration.

Useful 0 Not Useful 0