# CVE-2026-107929: curl local interface connection reuse mixup

Source: https://junglewise.ai/threats/cve-2026-107929-when-curlopt-interface-or-the-command-line-tool-s-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-107929 · Severity: info · Published 2026-10-20

curl is a widely used library and command-line tool for making network requests. When configured to bind to a specific local network interface via CURLOPT_INTERFACE, this setting is not properly tracked when reusing connections, allowing subsequent requests to silently route through an unintended source address. This can cause data to leak from or be associated with the wrong network interface.

Technologies: [Curl](https://junglewise.ai/threats/technologies/curl-curl). Vendors: [Curl](https://junglewise.ai/threats/vendors/curl).

## Quick answers

**Is CVE-2026-107929 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107929 being exploited in the wild.

**How severe is CVE-2026-107929?** Informational severity, published 20 October 2026.

**Which products and versions are affected?** Curl 8.9.0 to 8.22.0 (various branches); see fixed_in for branch-specific fixes.

**Is there a fix for CVE-2026-107929?** Yes: fixed in curl 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch). Until then: Avoid using CURLOPT_INTERFACE and the --interface option until upgrading to a patched version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107929 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-107929?** Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in curl 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch)

Avoid using CURLOPT_INTERFACE and the --interface option until upgrading to a patched version.

## Technical details

When CURLOPT_INTERFACE (or --interface) is set with prefixes like if!, host!, or ifhost!, the binding is omitted from the connection reuse key, causing later transfers requesting a different source to reuse an existing connection and inadvertently send traffic from the earlier transfer's source address. The vulnerability affects curl 8.9.0 through 8.22.0 and is fixed in 8.23.0, 8.20.2, 8.16.2, and 8.14.3 in their respective branches. This is a local issue with no network attack vector required.

## Affected products

- curl curl 8.9.0 to 8.22.0 (various branches); see fixed_in for branch-specific fixes

## Timeline

- 2026-10-14: disclosed
- 2026-10-14: patched

## References

- [https://curl.se/docs/CVE-2026-107929.html](https://curl.se/docs/CVE-2026-107929.html)
- [https://curl.se/docs/CVE-2026-107929.json](https://curl.se/docs/CVE-2026-107929.json)

## Related threats

- [libcurl credentials leak in CURLINFO_EFFECTIVE_URL](https://junglewise.ai/threats/cve-2026-94266-libcurl-could-accidentally-return-a-url-for-curl-easy-getinfo-s)
- [curl Negotiate authentication credential exposure on redirect](https://junglewise.ai/threats/cve-2026-94265-when-processing-an-http-redirect-to-a-url-containing-userinfo-a)
- [curl stack overflow in MIME structure cleanup](https://junglewise.ai/threats/cve-2026-92391-a-deeply-nested-multipart-mime-structure-constructed-via-the)
- [curl remote-header-name file overwrite bypass](https://junglewise.ai/threats/cve-2026-92390-when-invoked-with-remote-header-name-j-curl-fails-to-preserve-its)
- [curl infinite loop via server response omission](https://junglewise.ai/threats/cve-2026-92387-by-permanently-omitting-the-final-control-response-line-a)