Description (CNA)
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| curl / curl | affected 8.17.0 before 8.20.1 |
| curl / curl | affected eefd03c572996e5de4dec4fe295ad6f103e0eefc before d69bfad3fa3daf5e72331f6870667607828d5891 |
| curl / curl | affected 8.20.0; affected 8.19.0; affected 8.18.0; affected 8.17.0 |
CWE
CWE-295
References
- https://curl.se/docs/CVE-2026-11564.json
- https://curl.se/docs/CVE-2026-11564.html
- https://hackerone.com/reports/3788984
ADP enrichment
No English description supplied.