Is CVE-2026-9545 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9545 being exploited in the wild.

How severe is CVE-2026-9545?

Informational severity, published 3 July 2026.

Is there a fix for CVE-2026-9545?

A patch was published on 2026-06-24: Fixed in curl version 8.21.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9545 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9545?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9545: curl information exposure via HTTP/3 early data transmission

CVE-2026-9545 · Severity: info · Published 2026-07-03

curl is a widely used tool and library for transferring data over various network protocols. A security flaw in its HTTP/3 implementation could allow an attacker to intercept sensitive information, such as login credentials or private data, by impersonating a legitimate server. This occurs because the software may prematurely send data to a malicious server before verifying its security certificate during a resumed connection.

Quick answers

Is CVE-2026-9545 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9545 being exploited in the wild.
How severe is CVE-2026-9545?: Informational severity, published 3 July 2026.
Which products and versions are affected?: curl curl 8.11.0 to 8.20.0.
Is there a fix for CVE-2026-9545?: A patch was published on 2026-06-24: Fixed in curl version 8.21.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9545 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9545?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in libcurl's HTTP/3 implementation (specifically the ngtcp2 + nghttp3 backend) related to TLS 1.3 early data (0-RTT). When a client resumes a cached SSL session with early data enabled (CURLSSLOPT_EARLYDATA), libcurl may transmit the request payload on a new connection before completing the certificate verification process. If an attacker performs a machine-in-the-middle attack or replaces the legitimate server with an impostor lacking a valid certificate, sensitive request bytes could be leaked to the unauthorized actor. The issue is fixed in version 8.21.0 by ensuring certificate validation occurs before early data transmission.

Affected products

curl curl 8.11.0 to 8.20.0

Timeline

2026-05-19: disclosed: Reported to the curl project via HackerOne.
2026-06-24: patched: Fixed in curl version 8.21.0.
2026-06-24: advisory: Project curl security advisory published.
2026-07-03: other: CVE record published in NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.