curl: TLS session resumption client cert bypass with CURLOPT_SSL_CTX_FUNCTION

🗓️ 09 Sep 2026 20:15:13Reported by causalsecurityType

hackerone🔗 hackerone.com👁 5 Views

curl TLS session resumption leaks client cert identity from CURLOPT_SSL_CTX_FUNCTION callback.

Reporter	Title	Published	Views	Family All 189
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL affect PowerKVM	18 Jun 201801:34	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL/libcURL affect IBM Flex System Chassis Management Module	31 Jan 201902:25	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL affect IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru and QLogic Virtual Fabric Extension Module for IBM BladeCenter	14 Apr 202314:32	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL/libcURL affect IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware	7 Dec 202322:31	–	ibm
IBM Security Bulletins	Security Bulletin: Aspera Web Applications (Faspex, Console) and On Demand products are affected by OpenSSL Vulnerability (CVE-2017-7468)	14 Aug 201922:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple cURL/libcURL vulnerabilities (CVE-2016-5419, CVE-2016-5420, CVE-2016-7141)	18 Jun 201801:34	–	ibm
FreeBSD	cURL -- TLS session resumption client cert bypass (again)	19 Apr 201700:00	–	freebsd
FreeBSD	Vulnerabilities in Curl	3 Aug 201600:00	–	freebsd
Tenable Nessus	Mac OS X 10.x < 10.12.6 Multiple Vulnerabilities	27 Jul 201700:00	–	nessus
Tenable Nessus	cURL/libcurl 7.x < 7.50.1 Multiple Vulnerabilities	11 Nov 201600:00	–	nessus

14 Sep 2026 07:41Current

CVSS 25

CVSS 34.8 - 7.5

CVSS 3.17.5

EPSS0.15893

SSVC

curl TLS session resumption client certificate CURLOPT_SSL_CTX_FUNCTION session cache identity leak