{"id":"CVE-2026-11564","state":"PUBLISHED","title":"Native CA trust persist","description":"libcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup.\n\nAn easy handle that first uses default native CA trust can continue trusting\nthe native platform store after the application switches that same handle to\ncustom CA material for a later transfer.","publishedAt":"2026-07-03T06:12:35.251Z","updatedAt":"2026-09-15T06:02:39.718Z","severity":{"score":9.1,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"CISA-ADP"},"assigner":"curl","products":["curl curl"],"affected":[{"vendor":"curl","product":"curl","defaultStatus":"unaffected","versions":[{"version":"8.17.0","status":"affected","lessThan":"8.20.1","versionType":"semver"}]},{"vendor":"curl","product":"curl","defaultStatus":"unaffected","versions":[{"version":"eefd03c572996e5de4dec4fe295ad6f103e0eefc","status":"affected","lessThan":"d69bfad3fa3daf5e72331f6870667607828d5891","versionType":"git"}],"repo":"https://github.com/curl/curl.git"},{"vendor":"curl","product":"curl","defaultStatus":"unaffected","versions":[{"version":"8.20.0","status":"affected"},{"version":"8.19.0","status":"affected"},{"version":"8.18.0","status":"affected"},{"version":"8.17.0","status":"affected"}]}],"references":["https://curl.se/docs/CVE-2026-11564.json","https://curl.se/docs/CVE-2026-11564.html","https://hackerone.com/reports/3788984"],"weaknesses":["CWE-295"],"ingestedAt":"2026-10-29T20:10:52.580Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/11xxx/CVE-2026-11564.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-11564","state":"PUBLISHED","datePublished":"2026-07-03T06:12:35.251Z","dateUpdated":"2026-09-15T06:02:39.718Z","assignerShortName":"curl","assignerOrgId":"2499f714-1537-4658-8207-48ae4bb9eae9","dateReserved":"2026-06-08T08:22:50.089Z"},"containers":{"cna":{"title":"Native CA trust persist","descriptions":[{"lang":"en","value":"libcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup.\n\nAn easy handle that first uses default native CA trust can continue trusting\nthe native platform store after the application switches that same handle to\ncustom CA material for a later transfer."}],"affected":[{"vendor":"curl","product":"curl","defaultStatus":"unaffected","versions":[{"version":"8.17.0","status":"affected","lessThan":"8.20.1","versionType":"semver"}]},{"vendor":"curl","product":"curl","defaultStatus":"unaffected","versions":[{"version":"eefd03c572996e5de4dec4fe295ad6f103e0eefc","status":"affected","lessThan":"d69bfad3fa3daf5e72331f6870667607828d5891","versionType":"git"}],"repo":"https://github.com/curl/curl.git"},{"vendor":"curl","product":"curl","defaultStatus":"unaffected","versions":[{"version":"8.20.0","status":"affected"},{"version":"8.19.0","status":"affected"},{"version":"8.18.0","status":"affected"},{"version":"8.17.0","status":"affected"}]}],"references":[{"url":"https://curl.se/docs/CVE-2026-11564.json"},{"url":"https://curl.se/docs/CVE-2026-11564.html"},{"url":"https://hackerone.com/reports/3788984"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-295","lang":"en","description":"Improper Certificate Validation","type":"CWE"}]}],"providerMetadata":{"shortName":"curl","orgId":"2499f714-1537-4658-8207-48ae4bb9eae9","dateUpdated":"2026-09-15T06:02:39.718Z"},"x_osv":{"schema_version":"1.5.0","id":"CURL-CVE-2026-11564","aliases":["CVE-2026-11564"],"summary":"Native CA trust persist","modified":"2026-09-07T10:34:51.00Z","database_specific":{"package":"curl","affects":"lib","URL":"https://curl.se/docs/CVE-2026-11564.json","www":"https://curl.se/docs/CVE-2026-11564.html","issue":"https://hackerone.com/reports/3788984","CWE":{"id":"CWE-295","desc":"Improper Certificate Validation"},"last_affected":"8.20.0","severity":"Low"},"published":"2026-06-24T08:00:00.00Z","affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"8.17.0"},{"fixed":"8.20.1"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"eefd03c572996e5de4dec4fe295ad6f103e0eefc"},{"fixed":"d69bfad3fa3daf5e72331f6870667607828d5891"}]}],"versions":["8.20.0","8.19.0","8.18.0","8.17.0"]}],"credits":[{"name":"Filipe Casal of Trail of Bits in collaboration with OpenAI","type":"finder"},{"name":"Stefan Eissing","type":"remediation developer"}],"details":"libcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup.\n\nAn easy handle that first uses default native CA trust can continue trusting\nthe native platform store after the application switches that same handle to\ncustom CA material for a later transfer."},"credits":[{"lang":"en","value":"Filipe Casal of Trail of Bits in collaboration with OpenAI","type":"finder"},{"lang":"en","value":"Stefan Eissing","type":"remediation developer"}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://hackerone.com/reports/3788984","tags":["exploit"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-07-06T17:09:36.356822Z","id":"CVE-2026-11564","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-06T17:10:33.352Z"}}]}}}