# CVE-2026-8286: curl wrong STARTTLS connection reuse

Source: https://junglewise.ai/threats/cve-2026-8286-curl-wrong-starttls-connection-reuse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-8286 · Severity: info · Published 2026-07-03

A vulnerability in the curl data transfer tool could allow the software to incorrectly reuse an existing network connection for a new request, even if the security settings for the new request are different. This occurs when using protocols like email (IMAP, POP3, SMTP) or file transfer (FTP) that start in plain text and upgrade to encrypted communication via STARTTLS. In practice, this could lead to data being sent over a connection that does not meet the intended security or encryption requirements.

## Quick answers

**Is CVE-2026-8286 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8286 being exploited in the wild.

**How severe is CVE-2026-8286?** Informational severity, published 3 July 2026.

**Which products and versions are affected?** curl curl 7.30.0 to 8.20.0; curl libcurl 7.30.0 to 8.20.0.

**Is there a fix for CVE-2026-8286?** A patch was published on 2026-06-24: Fixed in curl 8.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8286 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8286?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A logical flaw exists in curl's connection reuse mechanism for protocols that utilize STARTTLS (IMAP, POP3, SMTP, FTP, and LDAP). When a new transfer is initiated that requires a STARTTLS upgrade, the validation logic intended to ensure TLS configuration consistency between the new transfer and an existing live connection is bypassed. Consequently, curl may reuse a connection that does not match the desired TLS parameters, potentially leading to improper certificate validation or weakened security posture. The issue is fixed in version 8.21.0 by ensuring configuration checks are performed during the STARTTLS upgrade path.

## Affected products

- curl curl 7.30.0 to 8.20.0
- curl libcurl 7.30.0 to 8.20.0

## Timeline

- 2026-05-06: disclosed: Reported to the curl project via HackerOne
- 2026-06-17: other: Contacted distros@openwall
- 2026-06-24: patched: Fixed in curl 8.21.0
- 2026-06-24: advisory: Project curl security advisory published

## References

- [https://curl.se/docs/CVE-2026-8286.html](https://curl.se/docs/CVE-2026-8286.html)
- [https://curl.se/docs/CVE-2026-8286.json](https://curl.se/docs/CVE-2026-8286.json)
- [https://hackerone.com/reports/3718195](https://hackerone.com/reports/3718195)