Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-107929

local interface connection reuse mixup

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
curl

Description

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

curl curl

Default version status: unaffected

  • 8.22.0 to ≤ 8.22.0affected
  • 8.21.0 to ≤ 8.21.0affected
  • 8.20.0 to ≤ 8.20.0affected
  • 8.19.0 to ≤ 8.19.0affected
  • 8.18.0 to ≤ 8.18.0affected
  • 8.17.0 to ≤ 8.17.0affected
  • 8.16.0 to ≤ 8.16.0affected
  • 8.15.0 to ≤ 8.15.0affected
  • 8.14.1 to ≤ 8.14.1affected
  • 8.14.0 to ≤ 8.14.0affected
  • 8.13.0 to ≤ 8.13.0affected
  • 8.12.1 to ≤ 8.12.1affected
  • 8.12.0 to ≤ 8.12.0affected
  • 8.11.1 to ≤ 8.11.1affected
  • 8.11.0 to ≤ 8.11.0affected
  • 8.10.1 to ≤ 8.10.1affected
  • 8.10.0 to ≤ 8.10.0affected
  • 8.9.1 to ≤ 8.9.1affected
  • 8.9.0 to ≤ 8.9.0affected

References