Every CVE Search/ Get API key

CVE-2026-11564

Native CA trust persist

9.1 CriticalFix available

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.

An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.61%Up 0.4 points since Jul 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.1

Native CA trust persist

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.

An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Record
CVE-2026-11564
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
EUVDEUVD-2026-41499 9.1

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.

An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Record
EUVD-2026-41499
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-hf82-6jff-f22v 9.1

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse...

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.

An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Record
GHSA-hf82-6jff-f22v
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
NVD 9.1

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.

An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Record
CVE-2026-11564
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
OSVALPINE-CVE-2026-11564 9.1

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.

An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Record
ALPINE-CVE-2026-11564
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVBELL-CVE-2026-11564 9.1
Record
BELL-CVE-2026-11564
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 11 moreShow less
OSV 9.1

Native CA trust persist

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.

An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Record
CVE-2026-11564
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-03
OSVDEBIAN-CVE-2026-11564 9.1

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Record
DEBIAN-CVE-2026-11564
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVJLSEC-2026-1199 9.1

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse...

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.

An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Record
JLSEC-2026-1199
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:29017 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:29017
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:34975 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:34975
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-11564 9.1

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Record
UBUNTU-CVE-2026-11564
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVCURL-CVE-2026-11564 No score

Native CA trust persist

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.

An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Record
CURL-CVE-2026-11564
Updated
2026-11-02
OSVopenSUSE-SU-2026:11230-1 No score

curl-8.21.0-1.1 on GA media

These are all security issues fixed in the curl-8.21.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11230-1
Updated
2026-11-02
OSVROOT-OS-ALPINE-323-CVE-2026-11564 No score

CVE-2026-11564 in curl - Patched by Root

Root has patched CVE-2026-11564 in the curl package for Root:Alpine:3.23. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-323-CVE-2026-11564
Updated
2026-11-02
OSVSUSE-SU-2026:5068-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
  • CVE-2026-9546: sending old referer (bsc#1268419).
  • CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
  • CVE-2026-11564: Native CA trust persist (bsc#1268424).
  • CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
  • CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
  • CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
  • CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
  • CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
  • CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
  • CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
  • CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
  • CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
  • CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
  • CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
  • CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
  • CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
  • CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
  • CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
  • CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
  • CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
  • CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
  • CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
  • CVE-2026-92389: TFTP direction confusion (bsc#1285015).
  • CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
  • CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
  • CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
  • CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
  • CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
  • CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

Changes for curl:

  • Updated curl to version 8.22.0. (jsc#PED-16984)
Record
SUSE-SU-2026:5068-1
Updated
2026-11-03
OSVSUSE-SU-2026:5069-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
  • CVE-2026-9546: sending old referer (bsc#1268419).
  • CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
  • CVE-2026-11564: Native CA trust persist (bsc#1268424).
  • CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
  • CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
  • CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
  • CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
  • CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
  • CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
  • CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
  • CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
  • CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
  • CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
  • CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
  • CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
  • CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
  • CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
  • CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
  • CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
  • CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
  • CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
  • CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
  • CVE-2026-92389: TFTP direction confusion (bsc#1285015).
  • CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
  • CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
  • CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
  • CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
  • CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
  • CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

Changes for curl:

  • Updated to version 8.22.0. (jsc#PED-16984)
Record
SUSE-SU-2026:5069-1
Updated
2026-11-03

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Alpine:v3.23
 8.17.0 up to 8.22.0-r0
8.22.0-r0
curl
Alpine:v3.24
 8.17.0 up to 8.21.0-r0
8.21.0-r0
curl
Alpaquita:23
 8.1.0-r2 up to 8.21.0-r0
8.21.0-r0
curl
Alpaquita:25
 8.14.0-r1 up to 8.21.0-r0
8.21.0-r0
curl
Alpaquita:stream
 8.1.2-r0 up to 8.21.0-r0
8.21.0-r0
curl
BellSoft Hardened Containers:stream
 8.1.2-r0 up to 8.21.0-r0
8.21.0-r0
curl
Debian:14
 before 8.21.0~rc2-1, plus listed versions
8.14.1-28.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp1
Show 45 moreShow less
8.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0-18.17.0-28.17.0-38.17.0~rc1-1~exp18.17.0~rc2-18.17.0~rc3-18.18.0-18.18.0-1~bpo13+18.18.0-28.18.0~rc1-1+exp18.18.0~rc2-18.18.0~rc3-18.19.0-18.19.0-1+exp18.19.0-1~bpo13+18.19.0-28.19.0-38.19.0-3+exp18.19.0-3+exp28.19.0~rc1-1~exp18.19.0~rc2-18.19.0~rc2-28.19.0~rc3-18.20.0-18.20.0-1+exp8.20.0-28.20.0-2+exp18.20.0-2~bpo13+18.20.0-38.20.0-48.20.0-5
8.21.0~rc2-1
CURL_jll
Julia
 8.17.0+0 up to 8.21.0+0
8.21.0+0
LibCURL_jll
Julia
 8.17.0+0 up to 8.21.0+0
8.21.0+0
curl
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
Show 27 moreShow less
Affected packages
PackageAffectedFixed
libcurl
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
libcurl-devel
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
libcurl-minimal
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:8.21.0-0.1.hum1
0:8.21.0-0.1.hum1
cargo
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
clippy
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-analyzer
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-debugger-common
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-doc
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-gdb
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-lldb
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-src
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-aarch64-unknown-none-softfloat
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-aarch64-unknown-uefi
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-i686-pc-windows-gnu
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-wasm32-unknown-unknown
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-wasm32-wasip1
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-x86_64-pc-windows-gnu
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-x86_64-unknown-none
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rust-std-static-x86_64-unknown-uefi
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
rustfmt
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:1.96.1-1.hum1
0:1.96.1-1.hum1
curl
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 31 CVEs
 before 8.22.0-150700.7.33.1
8.22.0-150700.7.33.1
curl
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 31 CVEs
 before 8.22.0-150600.4.58.1
8.22.0-150600.4.58.1
curl
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 31 CVEs
 before 8.22.0-150600.4.58.1
8.22.0-150600.4.58.1
curl
Ubuntu:26.04:LTS
 before 8.18.0-1ubuntu2.3, plus listed versions
8.14.1-2ubuntu18.17.0-1ubuntu18.18.0-1ubuntu18.18.0-1ubuntu28.18.0-1ubuntu2.18.18.0-1ubuntu2.2
8.18.0-1ubuntu2.3
curl
openSUSE:Tumbleweed
From an advisory covering 18 CVEs
 before 8.21.0-1.1
8.21.0-1.1

History

History
RecordedChangedSources
affectedOSV
affected, aliases, facts, referencesOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-11564 is a critical vulnerability (CVSS 9.1) in Curl, published June 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in curl 8.22.0-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 9 versions and 67 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open