CVE-2026-8932: incomplete mTLS config matching in conn reuse
Vendor fix available · Affected: curl · Exploitation: public proof of concept (unverified)
ExploitationProof of concept public
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public2 public GitHub repositories (unverified), listed by PoC-in-GitHub26 Jun
- Not established: not seen
Higher than 34% of scored CVEs
DescriptionNVD
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- curl
- Published
- July 2026
- Bounty reports
- 2 disclosed on HackerOne
Disclosed bug bounty reports about CVE-2026-8932
The reports on HackerOne that name this CVE, with HackerOne's own outcome. Titles and metadata only.
- OpenSSL ENGINE selection omitted from mTLS connection matchingcurl · 2026 · low severityInformative
- CVE-2026-8932: incomplete mTLS config matching in conn reusecurl · 2026 · low severityValid
What changed
- PoC-in-GitHub lists 2 public GitHub repositories (unverified) PoC-in-GitHub
Coverage2 articles · 2 outlets
One row per outlet, in order of first report. First in our coverage: SecurityWeek, 25 Jun.
- Thu 25 Jun, 09:32 UTC. SecurityWeek, first report. 25-Year-Old Vulnerability Patched in Curl.
- Thu 25 Jun, 20:21 UTC. Security Affairs, its first report on the story. Curl fixes 18 bugs including 25 year old CVE-2026-8932 in libcurl.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 25 Jun 09:32 | SecurityWeek | 25-Year-Old Vulnerability Patched in Curl |
| 25 Jun 20:21 | Security Affairs | Curl fixes 18 bugs including 25 year old CVE-2026-8932 in libcurl |
- 25-Year-Old Vulnerability Patched in CurlSecurityWeek · first in our coverage
New articles also arrive in the RSS feed.