Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-03T06:16:30 libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CWE-1025

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security (mTLS) settings, particularly those for client certificates, should have prevented such reuse. This issue could lead to a security feature bypass, where a client might use a connection with an unintended or weaker security configuration, potentially compromising the integrity or confidentiality of data.

This is an Important security feature bypass in libcurl where mTLS connection reuse may occur despite changes to client certificate settings. This could lead to applications using libcurl with mTLS to inadvertently use a less secure connection than intended, potentially compromising data confidentiality or integrity. This issue primarily affects applications that dynamically alter mTLS client certificate configurations and reuse connections. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Hardened Images 2026-06-24T00:00:00Z RHSA-2026:29017 curl-main-8.21.0-0.1.hum1 Red Hat Hardened Images 2026-07-02T00:00:00Z RHSA-2026:34975 rust-main-1.96.1-1.hum1 Red Hat Enterprise Linux 8 Not affected dotnet8.0 Red Hat JBoss Core Services Affected libcurl-1.dll Red Hat JBoss Core Services Affected libcurl.so https://www.cve.org/CVERecord?id=CVE-2026-8932 https://nvd.nist.gov/vuln/detail/CVE-2026-8932 https://curl.se/docs/CVE-2026-8932.html https://curl.se/docs/CVE-2026-8932.json https://hackerone.com/reports/3733910