Executive brief
curl and libcurl, widely used libraries for downloading files and making web requests, contain a flaw where they reuse existing HTTPS connections even when the certificate validation settings have changed. This could allow an attacker to bypass intended security controls and potentially access services using weaker or disabled certificate verification than the application intended.
Technical details
The vulnerability is a connection reuse logic error (CWE-488: Exposure of Data Element to Wrong Session) affecting curl versions 7.71.0 through 8.21.0 on Windows and macOS. When an application reuses a curl connection handle for multiple HTTPS requests, curl fails to account for changes to the CURLSSLOPT_NATIVE_CA setting between requests, wrongly reusing a prior connection established with different certificate validation parameters. An attacker must control or intercept network traffic and influence which certificate validation mode is used, or trick an application into making sequential requests with varying CA store settings. The flaw is fixed in curl 8.22.0 (released September 2, 2026) and patched versions 8.14.2, 8.16.1, and 8.20.1; workaround: set CURLOPT_FORBID_REUSE to prevent connection pooling.
Affected products
- curl curl 7.71.0 to 8.21.0 (Windows and macOS only)
Timeline
- 2026-09-02: disclosed: CVE-2026-80231 advisory published
- 2026-09-02: patched: curl 8.22.0 released with fix