Is CVE-2026-11564 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11564 being exploited in the wild.

How severe is CVE-2026-11564?

Informational severity, published 3 July 2026.

Is there a fix for CVE-2026-11564?

A patch was published on 2026-06-24: Fixed in curl version 8.21.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11564 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-11564?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11564: curl libcurl improper certificate validation via native CA trust persistence

CVE-2026-11564 · Severity: info · Published 2026-07-03

libcurl, a widely used library for transferring data, contains a flaw where it may incorrectly trust security certificates. When an application is configured to switch from using the operating system's default trusted certificates to a specific, restricted set of custom certificates, it may fail to clear the original trust settings. This could allow a connection to a server that should have been blocked under the new, stricter security rules.

Quick answers

Is CVE-2026-11564 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11564 being exploited in the wild.
How severe is CVE-2026-11564?: Informational severity, published 3 July 2026.
Which products and versions are affected?: curl curl 8.17.0 to 8.20.0.
Is there a fix for CVE-2026-11564?: A patch was published on 2026-06-24: Fixed in curl version 8.21.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11564 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-11564?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in libcurl's connection pooling mechanism allows native CA trust to persist across transfers. When an 'easy handle' is first used with the default native CA trust (common on Windows and Apple platforms) and subsequently updated to use custom CA material, the handle may continue to trust the native platform store. This occurs because the connection pool may reuse setup parameters incorrectly. The flaw affects builds using OpenSSL, GnuTLS, Schannel, or Rustls backends. Attackers could potentially leverage this to have libcurl accept TLS certificates that should have been rejected by the custom CA configuration.

Affected products

curl curl 8.17.0 to 8.20.0

Timeline

2026-06-05: disclosed: Reported to the curl project by Trail of Bits and OpenAI.
2026-06-24: patched: Fixed in curl version 8.21.0.
2026-06-24: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.