libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse

🗓️ 02 Jul 2026 15:43:28Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 2 Views

Libcurl may reuse mTLS connections, bypassing cert changes and risking data security.

Reporter	Title	Published	Views	Family All 39
attackerkb	CVE-2026-8932	3 Jul 202606:16	–	attackerkb
alpinelinux	CVE-2026-8932	3 Jul 202606:16	–	alpinelinux
cbl_mariner	CVE-2026-8932 affecting package curl for versions less than 8.11.1-10	12 Jul 202619:55	–	cbl_mariner
circl	CVE-2026-8932	24 Jun 202607:20	–	circl
curl	incomplete mTLS config matching in conn reuse	24 Jun 202608:00	–	curl
cve	CVE-2026-8932	3 Jul 202606:16	–	cve
cvelist	CVE-2026-8932 incomplete mTLS config matching in conn reuse	3 Jul 202606:16	–	cvelist
debiancve	CVE-2026-8932	3 Jul 202606:16	–	debiancve
euvd	EUVD-2026-41509	3 Jul 202606:16	–	euvd
hackerone	curl: CVE-2026-8932: incomplete mTLS config matching in conn reuse	13 May 202621:34	–	hackerone

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	20251124	aarch64	cargo	1.96.1-1.hum1	cargo-1.96.1-1.hum1.aarch64.rpm
Red Hat Hardened Images	20251124	x86_64	cargo	1.96.1-1.hum1	cargo-1.96.1-1.hum1.x86_64.rpm
Red Hat Hardened Images	20251124	noarch	rust-debugger-common	1.96.1-1.hum1	rust-debugger-common-1.96.1-1.hum1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-8932
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
curl	www.curl.se/docs/CVE-2026-8932.html
curl	www.curl.se/docs/CVE-2026-8932.json
hackerone	www.hackerone.com/reports/3733910
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-8932
cve	www.cve.org/CVERecord

15 Jul 2026 14:34Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.17.5

EPSS0.00368

SSVC

libcurl issue security bypass mutual TLS reuse client certificates security settings data integrity data confidentiality