Executive brief
libcurl is a widely-used library for making network requests in applications. When reusing connections with OpenSSL and toggling certificate chain validation settings, libcurl could incorrectly accept partial certificate chains that should have been rejected, potentially allowing fraudulent or compromised TLS certificates. This could lead to man-in-the-middle attacks and unauthorized access to sensitive data transmitted over HTTPS.
Technical details
The vulnerability is an improper certificate validation issue (CWE-295) in libcurl's OpenSSL backend. When the CURLSSLOPT_NO_PARTIALCHAIN option is toggled between transfers using reused easy or multi handles, libcurl may incorrectly reuse a cached CA store in memory with the opposite partial-chain policy flag set, causing it to accept certificate chains it should reject. This requires CA caching to be enabled (CURLOPT_CA_CACHE_TIMEOUT not set to zero) and only affects TLS transfers. No user interaction or authentication is required; however, the vulnerability only manifests when applications actively toggle this option between different transfer contexts, which is uncommon. Applications using fixed certificate validation policies are unaffected. The fix is available in curl 8.14.2, 8.16.1, 8.18.0 and later.
Affected products
- curl libcurl 7.87.0 through 8.17.0 (multiple fix branches: fixed in 8.14.2, 8.16.1, 8.18.0)
Timeline
- 2026-01-07: disclosed: Public advisory released
- 2026-01-07: patched: curl 8.18.0 released with fix