13 matches found
CVE-2026-86415
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...
CVE-2026-86415
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...
EUVD-2026-105307
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...
CVE-2026-86415
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...
CVE-2026-86415
A flaw was found in curl. In builds configured with the Microsoft Schannel Transport Layer Security TLS backend, libcurl's connection cache fails to evaluate client certificate authentication settings when handling HTTP redirects. A malicious server can redirect a transfer to a different...
CURL-CVE-2026-86415 auto client cert connection reuse mixup
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...
CVE-2026-86415
libcurl's connection cache matcher never considers the automatic client certficate option, so a cached, already authenticated Schannel connection can be handed to a transfer that just got redirected to a different origin, even though the code explicitly switched off the auto client cert option fo...
PT-2026-113743
Name of the Vulnerable Software and Affected Versions libcurl affected versions not specified Description The connection cache match function fails to consider the automatic client certificate option. This allows a cached Schannel connection that was already authenticated to be reused for a...
curl: HTTPS proxy connection reuse lets one easy handle inherit another handle's mTLS-authenticated proxy session
Summary: libcurl can reuse an already mTLS-authenticated HTTPS proxy TLS connection for a different easy handle even when that second handle does not have the proxy private key required to establish the session itself. The issue happens because the HTTPS proxy connection reuse identity does not...
curl: CVE-2026-3784: wrong proxy connection reuse with credentials
Summary libcurl may reuse an existing HTTP proxy CONNECT tunnel without matching proxy credentials when selecting a reusable connection. In lib/url.c, urlmatchproxyuse calls proxyinfomatches lib/url.c:930-935 → lib/url.c:589-595, and that matcher compares proxy type, host, and port but does not...
CVE-2024-0853 OCSP verification bypass with TLS session reuse
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status OCSP stapling test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check...
Vulnerability fixed in Red Hat Fuse
Red Hat has fixed a vulnerability in Fuse 7. The vulnerability is located in the Hazelcast integrated in Fuse Connection Cache and allows an unauthenticated malicious agent to able to manipulate data in the cluster without prior authentication or authorization. Red Hat has released updates to fix...
