CVE-2026-8932: incomplete mTLS config matching in conn reuse
incomplete mTLS config matching in conn reuse
Other sources
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.1-10 - Compensating control
Mitigate by disabling connection reuse in libcurl so that pooled connections are not reused when mTLS client-certificate/related TLS configuration changes (the issue is that libcurl can reuse a previously created connection even when some mTLS config match checks are insufficient, due to incomplete mTLS config matching in conn reuse).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8932?
CVE-2026-8932 has a risk rating of 21, indicating a significant security concern.
How does CVE-2026-8932 affect libcurl's connection management?
CVE-2026-8932 allows libcurl to reuse a connection even when mTLS configuration changes occur that should have prevented the reuse.
What are the potential risks of exploiting CVE-2026-8932?
Exploiting CVE-2026-8932 could lead to unauthorized access or data leakage due to improper mTLS connection handling.
How can I fix CVE-2026-8932 in my application?
To fix CVE-2026-8932, you should update libcurl to the latest version where the issue has been resolved.
When was CVE-2026-8932 published?
CVE-2026-8932 was published on July 3, 2026.