AZL-99831 CVE-2026-80231 affecting package rust 1.75.0-30

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...

AZL-99876 CVE-2026-80231 affecting package tensorflow 2.16.1-11

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...

AZL-99807 CVE-2026-80231 affecting package mysql 8.0.46-1

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...

AZL-99855 CVE-2026-80231 affecting package rust 1.90.0-10

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...

AZL-99774 CVE-2026-80231 affecting package cmake 3.30.3-15

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...

CVE-2026-80231 native CA store conn reuse

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...

CVE-2026-80231

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...

EUVD-2026-72169

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...

CVE-2026-80231

CVE-2026-80231 is a flaw in libcurl that causes it to wrongly reuse an existing HTTPS connection for a given hostname even when the Native CA Store setting (CURLSSLOPT_NATIVE_CA) differs from the one used at connection creation. The CVSS 3.1 score is 7.5 (HIGH) with a primary availability impact ...

native CA store conn reuse

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...

CURL-CVE-2026-80231 native CA store conn reuse

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...

PT-2026-84656

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description A flaw in libcurl causes the software to incorrectly reuse an existing HTTPS connection setup for a specific hostname, even if a different Native CA Store setting CURLSSLOPT NATIVE CA is used...

curl: CVE-2026-80231: native CA store conn reuse

Summary nativecastore is in struct sslconfigdata line 73 of vtlsconfig.h, not sslprimaryconfig. matchsslprimaryconfig does not compare it. On macOS, Curlssleasyconfigcomplete line 258 auto-sets nativecastore = TRUE when no custom CA is configured — without modifying ssloptions. When CURLCABUNDLE ...

libcurl 8.17.0 < 8.21.0 Native CA Trust Persist

The version of libcurl installed on the remote host is 8.17.0 prior to 8.21.0. It is, therefore, affected by an improper certificate validation vulnerability: - An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches th...

curl: CVE-2026-11564: Native CA trust persist

A vulnerability was discovered in the libcurl library where a native CA trust could persist after an easy handle switches to custom CA material. The vulnerability was found to affect builds of libcurl that enable the native CA trust feature. The issue stemmed from the fact that the library did no...

curl: CURLOPT_PROXY_CAINFO_BLOB silently activates native CA store on Apple builds

Hi all, CURLOPTPROXYCAINFOBLOB introduced 7.77.0 never sets proxyssl.customcablob. On USEAPPLESECTRUST / CURLCANATIVE builds this causes curl to silently fall back to the system keychain for proxy TLS verification, nullifying the caller's blob-only trust policy. --- Root cause lib/setopt.c handle...