Is CVE-2026-8932 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8932 being exploited in the wild.

How severe is CVE-2026-8932?

Informational severity, published 3 July 2026.

Is there a fix for CVE-2026-8932?

A patch was published on 2026-06-24: Fixed in curl version 8.21.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8932 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8932?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8932: curl libcurl authentication bypass via improper mTLS connection reuse

CVE-2026-8932 · Severity: info · Published 2026-07-03

libcurl, a widely used library for transferring data over various protocols, contains a flaw in how it manages secure connections. When an application attempts to establish a new secure connection using different client certificate settings (mTLS), libcurl may incorrectly reuse an existing connection that was established with different credentials. This could lead to an authentication bypass where a request is sent using the wrong identity, potentially exposing sensitive data or performing unauthorized actions.

Quick answers

Is CVE-2026-8932 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8932 being exploited in the wild.
How severe is CVE-2026-8932?: Informational severity, published 3 July 2026.
Which products and versions are affected?: curl libcurl 7.7 to 8.20.0.
Is there a fix for CVE-2026-8932?: A patch was published on 2026-06-24: Fixed in curl version 8.21.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8932 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8932?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in libcurl's connection reuse logic (CWE-305). libcurl maintains a pool of previously used connections to optimize performance; however, the logic responsible for matching a new request to an existing connection failed to account for certain TLS settings related to client certificates and private keys. Consequently, libcurl may reuse a connection for a transfer that should have required different mTLS credentials. This issue affects libcurl but not the curl command-line tool. The vulnerability is resolved in version 8.21.0 by ensuring all relevant mTLS configuration options are included in the connection matching checks.

Affected products

curl libcurl 7.7 to 8.20.0

Timeline

2026-05-13: disclosed: Reported to the curl project via HackerOne.
2026-06-24: patched: Fixed in curl version 8.21.0.
2026-06-24: advisory: Project curl security advisory published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.