# CVE-2026-82208: curl libcurl certificate validation bypass in wolfSSL backend

Source: https://junglewise.ai/threats/cve-2026-82208-curl-libcurl-certificate-validation-bypass-in-wolfssl-backend  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-82208 · Severity: high · CVSS 7.5 · Published 2026-09-06

libcurl is a widely-used open-source library for transferring data over HTTP and HTTPS. When built with the wolfSSL TLS backend, a flaw in certificate caching can cause libcurl to accept certificates that should have been rejected by custom validation logic. An attacker with a certificate trusted by the system but explicitly rejected by an application's security policy could use this to perform man-in-the-middle attacks or impersonate trusted services.

Technologies: [Haxx Curl](https://junglewise.ai/threats/technologies/curl). Vendors: [Haxx](https://junglewise.ai/threats/vendors/haxx).

## Quick answers

**Is CVE-2026-82208 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82208 being exploited in the wild.

**How severe is CVE-2026-82208?** High severity, with a CVSS score of 7.5, published 6 September 2026.

**Which products and versions are affected?** curl libcurl 8.9.1 to 8.14.1, 8.15.0 to 8.16.0, 8.17.0 to 8.20.0, 8.21.0.

**Is there a fix for CVE-2026-82208?** A patch was published on 2026-09-02: curl 8.22.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82208 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82208?** Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an improper certificate validation flaw (CWE-295) affecting libcurl's wolfSSL backend. When CA caching is enabled and an application provides a CURLOPT_SSL_CTX_FUNCTION callback to customize the trust store, libcurl incorrectly reinstalls the cached certificate store after the callback returns, overriding the callback's certificate validation decisions. This allows a certificate that the callback rejected but the cached store trusts to be silently accepted. The attack requires the application to use both CA caching and CURLOPT_SSL_CTX_FUNCTION callbacks with wolfSSL; the curl command-line tool is not affected. Patches were released in curl versions 8.14.2, 8.16.1, 8.20.1, and 8.22.0.

## Affected products

- curl libcurl 8.9.1 to 8.14.1, 8.15.0 to 8.16.0, 8.17.0 to 8.20.0, 8.21.0

## Timeline

- 2026-09-02: disclosed: Advisory published
- 2026-09-02: patched: curl 8.22.0 released with fix

## References

- [https://curl.se/docs/CVE-2026-82208.html](https://curl.se/docs/CVE-2026-82208.html)
- [https://curl.se/docs/CVE-2026-82208.json](https://curl.se/docs/CVE-2026-82208.json)

## Related threats

- [curl Public Suffix List domain boundary check bypass in cookie handling](https://junglewise.ai/threats/cve-2026-82209-curl-public-suffix-list-domain-boundary-check-bypass-in-cookie)
- [curl secure cookie attribute bypass with tab](https://junglewise.ai/threats/cve-2026-80255-curl-secure-cookie-attribute-bypass-with-tab)
- [curl HTTPS connection reuse with mismatched CA store settings](https://junglewise.ai/threats/cve-2026-80231-curl-https-connection-reuse-with-mismatched-ca-store-settings)
- [curl public key pinning bypass with disabled peer verification](https://junglewise.ai/threats/cve-2026-80230-curl-public-key-pinning-bypass-with-disabled-peer-verification)
- [curl OpenSSL provider use-after-free in TLS connections](https://junglewise.ai/threats/cve-2026-80229-curl-openssl-provider-use-after-free-in-tls-connections)