CVE-2026-9545 — exposing HTTP/3 early data

Description (CNA)

In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.

Affected (CNA)

Vendor / product	Versions
curl / curl	affected 8.11.0 before 8.14.2; affected 8.15.0 before 8.16.1; affected 8.17.0 before 8.20.1
curl / curl	affected 962097b8dd44ed5b9e7984bc1cdffdbdd566857f before 7b9613fa9b1a5e04301a3920eef58e8138dad05e
curl / curl	affected 8.20.0; affected 8.19.0; affected 8.18.0; affected 8.17.0; affected 8.16.0; affected 8.15.0; affected 8.14.1; affected 8.14.0; affected 8.13.0; affected 8.12.1; affected 8.12.0; affected 8.11.1; affected 8.11.0

CWE

CWE-200

References

ADP enrichment

CISA-ADP

No English description supplied.

https://hackerone.com/reports/3752888