6 matches found
CVE-2026-8932
π¨ CVE-2026-8932 - Π‘Π°ΠΌΠ°Ρ ΡΡΠ°ΡΠ°Ρ ΠΏΡΠΎΠ±Π»Π΅ΠΌΠ° Π±Π΅Π·ΠΎΠΏΠ°ΡΠ½ΠΎΡΡΠΈ libcurl ΠΠ΅ΠΏΠΎΠ»Π½ΠΎΠ΅ ΡΠΎΠΏΠΎΡΡΠ°Π²Π»Π΅Π½ΠΈΠ΅ ΠΊΠΎΠ½ΡΠΈΠ³ΡΡΠ°ΡΠΈΠΈ mTLS Π² libcurl Π‘Π°ΠΌΠ°Ρ ΡΡΠ°ΡΠ°Ρ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΡ, ΠΊΠΎΠ³Π΄Π°-Π»ΠΈΠ±ΠΎ ΠΈΡΠΏΡΠ°Π²Π»Π΅Π½Π½Π°Ρ Π² libcurl β ΠΎΡΡΠ°Π²Π°Π²ΡΠ°ΡΡΡ Π½Π΅Π·Π°ΠΌΠ΅ΡΠ΅Π½Π½ΠΎΠΉ Π±ΠΎΠ»Π΅Π΅ 25 Π»Π΅Ρ. π ΠΠ±Π·ΠΎΡ CVE-2026-8932 β ΡΡΠΎ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΡ Π² libcurl , ΠΏΡΠΈ ΠΊΠΎΡΠΎΡΠΎΠΉ Π±ΠΈΠ±Π»ΠΈΠΎΡΠ΅ΠΊΠ° ΠΌΠΎΠΆΠ΅Ρ...
curl: OpenSSL ENGINE selection omitted from mTLS connection matching
Summary When an application sets CURLOPTSSLENGINE to select an OpenSSL ENGINE for resolving ENG-type client certificate and private key identifiers, the engine selection is not included in the TLS configuration compared during connection reuse. A second easy handle with a different engine but the...
AZL-91827 CVE-2026-8932 affecting package cmake for versions less than 3.30.3-15
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS...
CVE-2022-31183
fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on...
