CVE-2026-9545: exposing HTTP/3 early data
In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate.
When libcurl returns to the hostname the second time with a cached SSL session (CURLOPTSSLSESSIONIDCACHE is not disabled) and early data enabled (the CURLSSLOPTEARLYDATA bit is set in CURLOPTSSLOPTIONS), libcurl might send off the second request's bytes on that new connection before enforcing the certificate verification failure. Potentially leaking sensitive information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.74.0-1.3+deb11u13Fixed in 7.74.0-1.3+deb11u16Fixed in 7.88.1-10+deb12u14Fixed in 7.88.1-10+deb12u5Fixed in 8.21.0-2 - Configuration
Disable HTTP/3 early data by ensuring the CURLSSLOPT_EARLYDATA bit is not set in CURLOPT_SSL_OPTIONS, since early data may be sent on an impostor connection before certificate verification failure.
libcurl CURLOPT_SSL_OPTIONS (CURLSSLOPT_EARLYDATA bit) = unset/disabled - Compensating control
Disable or avoid using a cached SSL session for the target hostname (CURLOPT_SSL_SESSIONID_CACHE is not disabled in the described scenario), so libcurl does not reuse a cached SSL session that could lead to sensitive information being sent on a replacement connection before verification failure.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9545?
CVE-2026-9545 has a risk score of 21, indicating a high level of concern due to potential exposure of sensitive data.
How do I fix CVE-2026-9545?
To fix CVE-2026-9545, update to the latest version of libcurl that addresses this vulnerability.
What are the potential impacts of CVE-2026-9545?
CVE-2026-9545 could allow an attacker to intercept and manipulate sensitive data due to HTTP/3 early data exposure.
Who is affected by CVE-2026-9545?
Users and systems utilizing the affected versions of libcurl for HTTP/3 communications are at risk from CVE-2026-9545.
What versions of libcurl are vulnerable to CVE-2026-9545?
CVE-2026-9545 affects earlier versions of libcurl that do not implement the necessary safeguards for HTTP/3 early data transfers.