Executive brief
libcurl is a widely-used open-source library for transferring data over HTTP and HTTPS. When built with the wolfSSL TLS backend, a flaw in certificate caching can cause libcurl to accept certificates that should have been rejected by custom validation logic. An attacker with a certificate trusted by the system but explicitly rejected by an application's security policy could use this to perform man-in-the-middle attacks or impersonate trusted services.
Technical details
This vulnerability is an improper certificate validation flaw (CWE-295) affecting libcurl's wolfSSL backend. When CA caching is enabled and an application provides a CURLOPT_SSL_CTX_FUNCTION callback to customize the trust store, libcurl incorrectly reinstalls the cached certificate store after the callback returns, overriding the callback's certificate validation decisions. This allows a certificate that the callback rejected but the cached store trusts to be silently accepted. The attack requires the application to use both CA caching and CURLOPT_SSL_CTX_FUNCTION callbacks with wolfSSL; the curl command-line tool is not affected. Patches were released in curl versions 8.14.2, 8.16.1, 8.20.1, and 8.22.0.
Affected products
- curl libcurl 8.9.1 to 8.14.1, 8.15.0 to 8.16.0, 8.17.0 to 8.20.0, 8.21.0
Timeline
- 2026-09-02: disclosed: Advisory published
- 2026-09-02: patched: curl 8.22.0 released with fix