Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-03T06:14:17 curl: curl: Insecure connection establishment due to TLS configuration mismatch 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CWE-295

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security (TLS) configuration of the new transfer does not match the existing connection, potentially leading to an insecure connection being established.

This is an Important flaw as `curl` may establish an insecure connection when attempting to upgrade a transfer with STARTTLS, potentially reusing an existing connection with mismatched TLS configurations. This could lead to unexpected data exposure or compromise, particularly in environments where `curl` is used for sensitive data transfers and relies on STARTTLS for security. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Hardened Images 2026-06-24T00:00:00Z RHSA-2026:29017 curl-main-8.21.0-0.1.hum1 Red Hat Hardened Images 2026-07-02T00:00:00Z RHSA-2026:34975 rust-main-1.96.1-1.hum1 Red Hat Enterprise Linux 10 Affected curl Red Hat Enterprise Linux 6 Affected curl Red Hat Enterprise Linux 7 Affected curl Red Hat Enterprise Linux 8 Affected curl Red Hat Enterprise Linux 9 Affected curl Red Hat OpenShift Container Platform 4 Affected rhcos Red Hat OpenShift Dev Spaces Affected devspaces/code-rhel9 Red Hat Trusted Profile Analyzer Affected rhtpa/rhtpa-trustification-service-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-8286 https://nvd.nist.gov/vuln/detail/CVE-2026-8286 https://curl.se/docs/CVE-2026-8286.html https://curl.se/docs/CVE-2026-8286.json https://hackerone.com/reports/3718195