# CVE-2026-80231: curl HTTPS connection reuse with mismatched CA store settings

Source: https://junglewise.ai/threats/cve-2026-80231-curl-https-connection-reuse-with-mismatched-ca-store-settings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-80231 · Severity: high · CVSS 7.5 · Published 2026-09-06

curl and libcurl, widely used libraries for downloading files and making web requests, contain a flaw where they reuse existing HTTPS connections even when the certificate validation settings have changed. This could allow an attacker to bypass intended security controls and potentially access services using weaker or disabled certificate verification than the application intended.

Technologies: [Haxx Curl](https://junglewise.ai/threats/technologies/curl). Vendors: [Haxx](https://junglewise.ai/threats/vendors/haxx).

## Quick answers

**Is CVE-2026-80231 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80231 being exploited in the wild.

**How severe is CVE-2026-80231?** High severity, with a CVSS score of 7.5, published 6 September 2026.

**Which products and versions are affected?** curl curl 7.71.0 to 8.21.0 (Windows and macOS only).

**Is there a fix for CVE-2026-80231?** A patch was published on 2026-09-02: curl 8.22.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-80231 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-80231?** Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a connection reuse logic error (CWE-488: Exposure of Data Element to Wrong Session) affecting curl versions 7.71.0 through 8.21.0 on Windows and macOS. When an application reuses a curl connection handle for multiple HTTPS requests, curl fails to account for changes to the CURLSSLOPT_NATIVE_CA setting between requests, wrongly reusing a prior connection established with different certificate validation parameters. An attacker must control or intercept network traffic and influence which certificate validation mode is used, or trick an application into making sequential requests with varying CA store settings. The flaw is fixed in curl 8.22.0 (released September 2, 2026) and patched versions 8.14.2, 8.16.1, and 8.20.1; workaround: set CURLOPT_FORBID_REUSE to prevent connection pooling.

## Affected products

- curl curl 7.71.0 to 8.21.0 (Windows and macOS only)

## Timeline

- 2026-09-02: disclosed: CVE-2026-80231 advisory published
- 2026-09-02: patched: curl 8.22.0 released with fix

## References

- [https://curl.se/docs/CVE-2026-80231.html](https://curl.se/docs/CVE-2026-80231.html)
- [https://curl.se/docs/CVE-2026-80231.json](https://curl.se/docs/CVE-2026-80231.json)

## Related threats

- [curl Public Suffix List domain boundary check bypass in cookie handling](https://junglewise.ai/threats/cve-2026-82209-curl-public-suffix-list-domain-boundary-check-bypass-in-cookie)
- [curl libcurl certificate validation bypass in wolfSSL backend](https://junglewise.ai/threats/cve-2026-82208-curl-libcurl-certificate-validation-bypass-in-wolfssl-backend)
- [curl secure cookie attribute bypass with tab](https://junglewise.ai/threats/cve-2026-80255-curl-secure-cookie-attribute-bypass-with-tab)
- [curl public key pinning bypass with disabled peer verification](https://junglewise.ai/threats/cve-2026-80230-curl-public-key-pinning-bypass-with-disabled-peer-verification)
- [curl OpenSSL provider use-after-free in TLS connections](https://junglewise.ai/threats/cve-2026-80229-curl-openssl-provider-use-after-free-in-tls-connections)