curl: TLS session cache ignores CURLOPT_SSL_CTX_FUNCTION identity and resumes one client's session for another

🗓️ 20 Oct 2026 00:12:25Reported by jashu19Type

hackerone🔗 hackerone.com👁 7 Views

curl TLS session cache ignores CURLOPT_SSL_CTX_FUNCTION identity, resuming wrong sessions.

Reporter	Title	Published	Views	Family All 168
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL affect PowerKVM	18 Jun 201801:34	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL/libcURL affect IBM Flex System Chassis Management Module	31 Jan 201902:25	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL affect IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru and QLogic Virtual Fabric Extension Module for IBM BladeCenter	14 Apr 202314:32	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL/libcURL affect IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware	7 Dec 202322:31	–	ibm
IBM Security Bulletins	Security Bulletin: Aspera Web Applications (Faspex, Console) and On Demand products are affected by OpenSSL Vulnerability (CVE-2017-7468)	14 Aug 201922:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple cURL/libcURL vulnerabilities (CVE-2016-5419, CVE-2016-5420, CVE-2016-7141)	18 Jun 201801:34	–	ibm
FreeBSD	cURL -- TLS session resumption client cert bypass (again)	19 Apr 201700:00	–	freebsd
FreeBSD	Vulnerabilities in Curl	3 Aug 201600:00	–	freebsd
Tenable Nessus	Mac OS X 10.x < 10.12.6 Multiple Vulnerabilities	27 Jul 201700:00	–	nessus
Tenable Nessus	cURL/libcurl 7.x < 7.50.1 Multiple Vulnerabilities	11 Nov 201600:00	–	nessus

20 Oct 2026 17:00Current

6.4Medium risk

Vulners AI Score6.4

CVSS 25

CVSS 34.8 - 7.5

EPSS0.15063

curl TLS session cache CWE-295 wrong client identity lib/vtls/vtls_scache.c