CVE-2026-80231

Published: Sep 6, 2026Modified: Sep 15, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.

Affected (1)

Products: Haxx: Curl

Haxx

1 product

Curl

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Haxx Curl	7.71.0 ≤ version < 8.22.0

Related CWEs

CWE-488

Exposure of Data Element to Wrong Session

The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

References (4)

https://curl.se/docs/CVE-2026-80231.html

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

MitigationPatchVendor Advisory

https://curl.se/docs/CVE-2026-80231.json

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Vendor Advisory

https://hackerone.com/reports/3969368

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

ExploitMitigationThird Party Advisory

https://hackerone.com/reports/3969368

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationThird Party Advisory

Timeline

No history available yet.