Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-03T06:17:55 libcurl: libcurl: Information disclosure via cached SSL session and early data 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-295

In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.

A flaw was found in libcurl. An attacker can exploit this by replacing a legitimate HTTP/3 server with an impostor machine. When libcurl attempts a second transfer to the same site with a cached SSL session and early data enabled, it may send sensitive request data before verifying the server's certificate. This could lead to the disclosure of sensitive information to the attacker.

This Moderate impact information disclosure flaw in libcurl arises when an application uses HTTP/3 with both SSL session caching and early data enabled. An attacker could exploit this by impersonating a legitimate server, leading to sensitive data being sent before certificate verification fails. This scenario requires specific libcurl configurations that may not be enabled by default in all Red Hat products. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Enterprise Linux 8 Not affected dotnet8.0 Red Hat JBoss Core Services Affected libcurl-1.dll Red Hat JBoss Core Services Affected libcurl.so https://www.cve.org/CVERecord?id=CVE-2026-9545 https://nvd.nist.gov/vuln/detail/CVE-2026-9545 https://curl.se/docs/CVE-2026-9545.html https://curl.se/docs/CVE-2026-9545.json https://hackerone.com/reports/3752888