Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-03T06:12:35 libcurl: libcurl: Certificate validation bypass due to incorrect connection reuse 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CWE-295

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

A flaw was found in curl. When libcurl reuses a connection from its connection pool, an easy handle that initially used default native Certificate Authority (CA) trust may continue to trust the native platform store. This occurs even after the application has switched that same handle to custom CA material for a subsequent transfer, potentially bypassing intended certificate validation.

This Moderate flaw in curl allows a certificate validation bypass. When libcurl reuses a connection, an application that switches from default native CA trust to custom CA material on the same handle may inadvertently continue to trust the native platform store. This could lead to a bypass of intended certificate validation, as the custom CA material might not be correctly applied, potentially allowing connections to untrusted endpoints. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Hardened Images 2026-06-24T00:00:00Z RHSA-2026:29017 curl-main-8.21.0-0.1.hum1 Red Hat Hardened Images 2026-07-02T00:00:00Z RHSA-2026:34975 rust-main-1.96.1-1.hum1 Red Hat Enterprise Linux 8 Not affected dotnet8.0 Red Hat JBoss Core Services Affected libcurl-1.dll Red Hat JBoss Core Services Affected libcurl.so https://www.cve.org/CVERecord?id=CVE-2026-11564 https://nvd.nist.gov/vuln/detail/CVE-2026-11564 https://curl.se/docs/CVE-2026-11564.html https://curl.se/docs/CVE-2026-11564.json https://hackerone.com/reports/3788984