Executive brief
libcurl, a widely used library for transferring data, contains a flaw where it may incorrectly trust security certificates. When an application is configured to switch from using the operating system's default trusted certificates to a specific, restricted set of custom certificates, it may fail to clear the original trust settings. This could allow a connection to a server that should have been blocked under the new, stricter security rules.
Technical details
A vulnerability in libcurl's connection pooling mechanism allows native CA trust to persist across transfers. When an 'easy handle' is first used with the default native CA trust (common on Windows and Apple platforms) and subsequently updated to use custom CA material, the handle may continue to trust the native platform store. This occurs because the connection pool may reuse setup parameters incorrectly. The flaw affects builds using OpenSSL, GnuTLS, Schannel, or Rustls backends. Attackers could potentially leverage this to have libcurl accept TLS certificates that should have been rejected by the custom CA configuration.
Affected products
- curl curl 8.17.0 to 8.20.0
Timeline
- 2026-06-05: disclosed: Reported to the curl project by Trail of Bits and OpenAI.
- 2026-06-24: patched: Fixed in curl version 8.21.0.
- 2026-06-24: advisory