Vulnerability · Published Jul 3, 2026 · Assigned by curl
CVE-2026-8932incomplete mTLS config matching in conn reuse
High 7.5
In plain English
A high-severity security flaw in curl from curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | curl | 8.12.1-4.el10_2.6 | ALSA-2026:69125 |
| AlmaLinux:8 | curl | 7.61.1-34.el8_10.18 | ALSA-2026:92368 |
| AlmaLinux:9 | curl | 7.76.1-40.el9_8.9 | ALSA-2026:92907 |
| AlmaLinux:9 | curl-minimal | 7.76.1-40.el9_8.9 | ALSA-2026:92907 |
| AlmaLinux:10 | libcurl | 8.12.1-4.el10_2.6 | ALSA-2026:69125 |
| AlmaLinux:8 | libcurl | 7.61.1-34.el8_10.18 | ALSA-2026:92368 |
| AlmaLinux:9 | libcurl | 7.76.1-40.el9_8.9 | ALSA-2026:92907 |
| AlmaLinux:10 | libcurl-devel | 8.12.1-4.el10_2.6 | ALSA-2026:69125 |
| AlmaLinux:8 | libcurl-devel | 7.61.1-34.el8_10.18 | ALSA-2026:92368 |
| AlmaLinux:9 | libcurl-devel | 7.76.1-40.el9_8.9 | ALSA-2026:92907 |
| AlmaLinux:10 | libcurl-minimal | 8.12.1-4.el10_2.6 | ALSA-2026:69125 |
| AlmaLinux:8 | libcurl-minimal | 7.61.1-34.el8_10.18 | ALSA-2026:92368 |
| AlmaLinux:9 | libcurl-minimal | 7.76.1-40.el9_8.9 | ALSA-2026:92907 |
| Alpine:v3.23 | curl | 8.22.0-r0 | ALPINE-CVE-2026-8932 |
| Alpine:v3.24 | curl | 8.21.0-r0 | ALPINE-CVE-2026-8932 |
| Debian:12 | curl | no fix listed | DEBIAN-CVE-2026-8932 |
| Debian:13 | curl | no fix listed | DEBIAN-CVE-2026-8932 |
| Debian:14 | curl | 8.21.0~rc2-1 | DEBIAN-CVE-2026-8932 |
| Rocky Linux:10 | curl | 0:8.12.1-4.el10_2.6 | RLSA-2026:69125 |
| Rocky Linux:8 | curl | 0:7.61.1-34.el8_10.18 | RLSA-2026:92368 |
| Rocky Linux:9 | curl | 0:7.76.1-40.el9_8.9 | RLSA-2026:92907 |
| Ubuntu:22.04:LTS | curl | 7.81.0-1ubuntu1.27 | UBUNTU-CVE-2026-8932 |
| Ubuntu:22.04:LTS | curl | 7.81.0-1ubuntu1.27 | USN-8670-2 |
| Ubuntu:24.04:LTS | curl | 8.5.0-2ubuntu10.13 | UBUNTU-CVE-2026-8932 |
| Ubuntu:24.04:LTS | curl | 8.5.0-2ubuntu10.13 | USN-8670-1 |
| Ubuntu:25.10 | curl | no fix listed | UBUNTU-CVE-2026-8932 |
| Ubuntu:26.04:LTS | curl | 8.18.0-1ubuntu2.5 | UBUNTU-CVE-2026-8932 |
| Ubuntu:26.04:LTS | curl | 8.18.0-1ubuntu2.5 | USN-8670-3 |
Affected products (as reported)
Weakness: CWE-305 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N