curl: 33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231)

🗓️ 26 Aug 2026 16:07:57Reported by giant_anteaterType

hackerone🔗 hackerone.com👁 7 Views

curl CONNECT_ONLY raw I/O selects wrong connection after share detach; incomplete CVE-2020-8231 fix.

Reporter	Title	Published	Views	Family All 171
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Analyst Workflow add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	27 Jan 202123:48	–	ibm
IBM Security Bulletins	Security Bulletin: Watson Machine Learning Community Edition docker containers have been updated to fix a security issue in libcurl	4 Feb 202123:53	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - curl (CVE-2020-8231)	21 Apr 202220:41	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Curl affects PowerSC (CVE-2020-8231)	1 Feb 202120:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities	3 Dec 202118:52	–	ibm
ATTACKERKB	CVE-2020-8231	14 Dec 202020:15	–	attackerkb
Tenable Nessus	Amazon Linux 2 : curl (ALAS-2021-1693)	6 Aug 202100:00	–	nessus
Tenable Nessus	Amazon Linux AMI : curl (ALAS-2020-1444)	18 Nov 202000:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0078: curl (ALINUX3-SA-2021:0078)	14 May 202500:00	–	nessus

31 Aug 2026 07:02Current

6.7Medium risk

Vulners AI Score6.7

CVSS 25

CVSS 3.17.5

EPSS0.03721

curl CONNECT_ONLY shared connection pool pool-local ID collision incomplete fix wrong connection raw I/O