Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2026-11564

Native CA trust persist

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
curl

Description

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

curl curl

Default version status: unaffected

  • 8.17.0 to < 8.20.1affected

curl curl

Default version status: unaffected

  • eefd03c572996e5de4dec4fe295ad6f103e0eefc to < d69bfad3fa3daf5e72331f6870667607828d5891affected

curl curl

Default version status: unaffected

  • 8.20.0affected
  • 8.19.0affected
  • 8.18.0affected
  • 8.17.0affected

References