{"id":"CVE-2026-80231","aliases":["ALPINE-CVE-2026-80231","AZL-99758","AZL-99774","AZL-99807","AZL-99831","AZL-99855","AZL-99876","BELL-CVE-2026-80231","CURL-CVE-2026-80231","EUVD-2026-72169","GHSA-r8j3-cwj5-4j73","MGASA-2026-0515","OESA-2026-4124","OESA-2026-4125","OESA-2026-4126","OESA-2026-4127","OESA-2026-4128","RHSA-2026:63161","ROOT-OS-ALPINE-315-CVE-2026-80231","ROOT-OS-ALPINE-317-CVE-2026-80231","ROOT-OS-ALPINE-320-CVE-2026-80231","ROOT-OS-ALPINE-321-CVE-2026-80231","ROOT-OS-ALPINE-322-CVE-2026-80231","UBUNTU-CVE-2026-80231"],"status":"published","title":"native CA store conn reuse","description":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00898,"percentile":0.59919,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-488"],"published":"2026-09-02T00:00:00Z","modified":"2026-11-04T17:16:12Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.22.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.22.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"curl","fixed_in":["8.22.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"curl","fixed_in":["8.22.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.22.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.22.0-r0"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"curl","fixed_in":["8.5.0-r00073","8.5.0-r00074","8.5.0-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"rootio-curl","fixed_in":["8.5.0-r00073","8.5.0-r00074","8.5.0-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.17","package":"curl","fixed_in":["8.9.0-r00076","8.9.0-r00077"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.17","package":"rootio-curl","fixed_in":["8.9.0-r00076","8.9.0-r00077"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"curl","fixed_in":["8.14.1-r200711","8.14.1-r200712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-curl","fixed_in":["8.14.1-r200711","8.14.1-r200712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"curl","fixed_in":["8.14.1-r30078","8.14.1-r20075","8.14.1-r20076","8.14.1-r20077","8.14.1-r30079","8.14.1-r300710","8.14.1-r300711","8.14.1-r300712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"rootio-curl","fixed_in":["8.14.1-r30078","8.14.1-r20075","8.14.1-r20076","8.14.1-r20077","8.14.1-r30079","8.14.1-r300710","8.14.1-r300711","8.14.1-r300712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"curl","fixed_in":["8.14.1-r400710","8.14.1-r30077","8.14.1-r30078","8.14.1-r30079"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"rootio-curl","fixed_in":["8.14.1-r400710","8.14.1-r30077","8.14.1-r30078","8.14.1-r30079"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.71.0"},{"fixed":"8.22.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.71.0"},{"fixed":"8.22.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"8.11.1-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.30.3-15"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"8.0.46-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.75.0-30"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"last_affected":"1.90.0-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"tensorflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.16.1-11"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0-r2"},{"fixed":"8.22.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.14.0-r1"},{"fixed":"8.22.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.22.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.22.0-r0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.23.0-1.mga10"}]}],"bundled":31},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-54.oe2003sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-56.oe2203sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-37.oe2403sp1"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-37.oe2403sp3"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-37.oe2403sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.22.0-0.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.22.0-0.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.22.0-0.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.22.0-0.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-r00073"},{"fixed":"8.5.0-r00074"},{"fixed":"8.5.0-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-r00073"},{"fixed":"8.5.0-r00074"},{"fixed":"8.5.0-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r00076"},{"fixed":"8.9.0-r00077"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.17","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r00076"},{"fixed":"8.9.0-r00077"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r200711"},{"fixed":"8.14.1-r200712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r200711"},{"fixed":"8.14.1-r200712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r20075"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r30079"},{"fixed":"8.14.1-r300710"},{"fixed":"8.14.1-r300711"},{"fixed":"8.14.1-r300712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r20075"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r30079"},{"fixed":"8.14.1-r300710"},{"fixed":"8.14.1-r300711"},{"fixed":"8.14.1-r300712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r400710"},{"fixed":"8.14.1-r30077"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r30079"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r400710"},{"fixed":"8.14.1-r30077"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r30079"}]}]}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"}],"references":[{"url":"https://curl.se/docs/CVE-2026-80231.json","tags":["Vendor Advisory","web","article"]},{"url":"https://curl.se/docs/CVE-2026-80231.html","tags":["Mitigation","Patch","Vendor Advisory","web","article","report"]},{"url":"https://hackerone.com/reports/3969368","tags":["exploit","Exploit","Mitigation","Third Party Advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80231","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-r8j3-cwj5-4j73"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-80231","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-80231","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80231.json","tags":["advisory"]},{"url":"https://github.com/curl/curl.git","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0515.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36250","tags":["report"]},{"url":"https://curl.se/docs/security.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4124","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4125","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4126","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13608","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4127","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4128","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63161","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19931","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13608","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18924","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82209","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80231","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80230","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80229","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80255","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63161.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529198","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13608","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-13608.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-13608.json","tags":["article"]},{"url":"https://hackerone.com/reports/3822248","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529201","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18924","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-18924.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-18924.json","tags":["article"]},{"url":"https://hackerone.com/reports/3916059","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529199","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19931","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-19931.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-19931.json","tags":["article"]},{"url":"https://hackerone.com/reports/3923520","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529206","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80229","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80229","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-80229.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-80229.json","tags":["article"]},{"url":"https://hackerone.com/reports/3969255","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529203","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80230","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-80230.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-80230.json","tags":["article"]},{"url":"https://hackerone.com/reports/3969300","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529204","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80231","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529205","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80255","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80255","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-80255.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-80255.json","tags":["article"]},{"url":"https://hackerone.com/reports/3972395","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529207","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82209","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-82209.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-82209.json","tags":["article"]},{"url":"https://hackerone.com/reports/3972385","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-80231","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-80231","title":"native CA store conn reuse","description":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.","status":"published","published":"2026-09-06T17:48:38.062Z","modified":"2026-09-15T06:03:11.962Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-488","CWE-488"],"updated_at":"2026-11-02T13:45:25.313702Z"}],"euvd":[{"id":"EUVD-2026-72169","description":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.","status":"published","published":"2026-09-06T17:48:38Z","modified":"2026-09-15T06:03:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:19.01786Z"}],"ghsa":[{"id":"GHSA-r8j3-cwj5-4j73","title":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname...","description":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.","status":"published","published":"2026-09-06T18:34:39Z","modified":"2026-09-08T21:34:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-488"],"updated_at":"2026-11-02T15:11:35.275364Z"}],"nvd":[{"id":"CVE-2026-80231","description":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.","status":"published","published":"2026-09-06T18:17:22.5Z","modified":"2026-09-15T07:16:30.57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-488"],"updated_at":"2026-11-02T14:12:44.082631Z"}],"osv":[{"id":"ALPINE-CVE-2026-80231","description":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.","status":"published","published":"2026-09-06T18:17:22.5Z","modified":"2026-10-01T02:17:49.413466913Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-80231","status":"published","published":"2026-09-04T06:05:07.890038Z","modified":"2026-09-10T07:15:04.933194508Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:26.041478Z"},{"id":"CVE-2026-80231","title":"native CA store conn reuse","description":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.","status":"published","published":"2026-09-06T17:48:38.062Z","modified":"2026-10-28T11:00:40.133921166Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-488"],"updated_at":"2026-11-02T15:45:17.44708Z"},{"id":"OESA-2026-4124","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nSuccessfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.(CVE-2026-11856)\n\nA flaw in libcurl\u0026apos;s handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process.(CVE-2026-18924)\n\nA flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B\u0026apos;s request get sent over user A\u0026apos;s\npreviously authenticated connection.(CVE-2026-19931)\n\nWhen `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)\n\nA flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.(CVE-2026-80231)\n\nWhen libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`).(CVE-2026-82209)","status":"published","published":"2026-09-25T01:28:45Z","modified":"2026-09-25T01:45:14.616534315Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4125","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nSuccessfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.(CVE-2026-11856)\n\nA flaw in libcurl\u0026apos;s handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process.(CVE-2026-18924)\n\nA flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B\u0026apos;s request get sent over user A\u0026apos;s\npreviously authenticated connection.(CVE-2026-19931)\n\nWhen `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)\n\nA flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.(CVE-2026-80231)\n\nWhen libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`).(CVE-2026-82209)","status":"published","published":"2026-09-25T01:28:45Z","modified":"2026-09-25T01:45:09.204392978Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4126","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nSuccessfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.(CVE-2026-11856)\n\nA flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation.(CVE-2026-13608)\n\nA flaw in libcurl\u0026apos;s handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process.(CVE-2026-18924)\n\nA flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B\u0026apos;s request get sent over user A\u0026apos;s\npreviously authenticated connection.(CVE-2026-19931)\n\nWhen `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)\n\nA flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.(CVE-2026-80231)\n\nWhen libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`).(CVE-2026-82209)","status":"published","published":"2026-09-25T01:28:47Z","modified":"2026-09-25T01:45:13.706912325Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4127","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nSuccessfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.(CVE-2026-11856)\n\nA flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation.(CVE-2026-13608)\n\nA flaw in libcurl\u0026apos;s handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process.(CVE-2026-18924)\n\nA flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B\u0026apos;s request get sent over user A\u0026apos;s\npreviously authenticated connection.(CVE-2026-19931)\n\nWhen `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)\n\nA flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.(CVE-2026-80231)\n\nWhen libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`).(CVE-2026-82209)","status":"published","published":"2026-09-25T01:28:47Z","modified":"2026-09-25T01:45:14.613657768Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4128","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nSuccessfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.(CVE-2026-11856)\n\nA flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation.(CVE-2026-13608)\n\nA flaw in libcurl\u0026apos;s handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process.(CVE-2026-18924)\n\nA flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B\u0026apos;s request get sent over user A\u0026apos;s\npreviously authenticated connection.(CVE-2026-19931)\n\nWhen `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)\n\nA flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.(CVE-2026-80231)\n\nWhen libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`).(CVE-2026-82209)","status":"published","published":"2026-09-25T01:28:47Z","modified":"2026-09-25T01:45:14.618674629Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:63161","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:17:20Z","modified":"2026-10-20T10:43:35.797896375Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"UBUNTU-CVE-2026-80231","description":"[Unknown description]","status":"withdrawn","published":"2026-09-02T00:00:00Z","modified":"2026-09-11T02:30:03.228365661Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:18.015985Z"},{"id":"AZL-99758","title":"CVE-2026-80231 affecting package curl 8.11.1-11","description":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.","status":"published","published":"2026-09-06T18:17:22Z","modified":"2026-09-14T05:26:59Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"AZL-99774","title":"CVE-2026-80231 affecting package cmake 3.30.3-15","description":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.","status":"published","published":"2026-09-06T18:17:22Z","modified":"2026-09-14T05:26:59Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"AZL-99807","title":"CVE-2026-80231 affecting package mysql 8.0.46-1","description":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.","status":"published","published":"2026-09-06T18:17:22Z","modified":"2026-09-08T12:40:48.48301Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"AZL-99831","title":"CVE-2026-80231 affecting package rust 1.75.0-30","description":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.","status":"published","published":"2026-09-06T18:17:22Z","modified":"2026-09-08T12:41:29.512457Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"AZL-99855","title":"CVE-2026-80231 affecting package rust 1.90.0-10","description":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.","status":"published","published":"2026-09-06T18:17:22Z","modified":"2026-09-08T12:42:04.888701Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"AZL-99876","title":"CVE-2026-80231 affecting package tensorflow 2.16.1-11","description":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.","status":"published","published":"2026-09-06T18:17:22Z","modified":"2026-09-08T12:41:20.001265Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"CURL-CVE-2026-80231","title":"native CA store conn reuse","description":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.","status":"published","published":"2026-09-02T08:00:00Z","modified":"2026-10-25T01:05:15.358577496Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"MGASA-2026-0515","title":"Updated curl package fixes security vulnerabilities","description":"curl 8.23.0 has been released. It fixes 24 CVEs since 8.22.0, listed at\nhttps://curl.se/docs/security.html\nNot all of theses CVEs affect Mageia. Of the ones fixed in 8.23.0, these\nare the ones that do:\nCVE-2026-86410: redirect to SFTP or SCP bypasses host verification\nCVE-2026-86412: server-set cookie erases cookie jar\nCVE-2026-86413: Negotiate credentials sent to redirected origin\nCVE-2026-86414: leaking host credentials to HTTP proxy\nCVE-2026-86415: auto client cert connection reuse mixup\nCVE-2026-87861: cross-origin reuse of a Negotiate connection\nCVE-2026-87862: HSTS cache import drops longer-lived child\nCVE-2026-87863: HSTS response erases persisted entries\nCVE-2026-92386: server-set cookie aborts cookie jar load\nCVE-2026-92387: never-ending loop via server response omission\nCVE-2026-92388: FTP wildcard write callback mixup\nCVE-2026-92389: TFTP direction confusion\nCVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints\nCVE-2026-92391: curl_mime_free stack overflow by recursion\nCVE-2026-92392: HTTP/2 upload Use-After-Free\nCVE-2026-94265: Authorization: Negotiate sent to foreign origin\nCVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL\nCVE-2026-107929: local interface connection reuse mixup\nThere were also some CVE IDs released at the same time that were fixed\nearlier, in 8.22.0, but just announced now:\nCVE-2026-86409: stale SigV4 headers sent unintended\nCVE-2026-86411: FTP connection reuse inherits client-certificate\nCVE-2026-87864: IMAP APPEND plus CRLF conversion command injection\nHere are the CVEs fixed in 8.22.0, which wasn't released in mga10 and so\nare only getting fixed now:\nCVE-2026-13608: OpenLDAP SASL authentication bypass\nCVE-2026-18924: HTTP/2 server push UAF\nCVE-2026-19931: Negotiate ambient user conn reuse\nCVE-2026-80229: OpenSSL provider use-after-free\nCVE-2026-80230: OpenSSL pinning bypass\nCVE-2026-80255: secure cookie attribute bypass with tab\nCVE-2026-82209: domain-scoped PSL domain cookie\n","status":"published","published":"2026-10-17T03:21:49Z","modified":"2026-10-17T03:43:01.411193688Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"ROOT-OS-ALPINE-315-CVE-2026-80231","title":"CVE-2026-80231 in curl - Patched by Root","description":"Root has patched CVE-2026-80231 in the curl package for Root:Alpine:3.15. Multiple fixed versions available.","status":"published","published":"2026-11-04T10:54:49Z","modified":"2026-11-04T11:15:04.147026238Z","updated_at":"2026-11-04T11:38:21.953745Z"},{"id":"ROOT-OS-ALPINE-317-CVE-2026-80231","title":"CVE-2026-80231 in curl - Patched by Root","description":"Root has patched CVE-2026-80231 in the curl package for Root:Alpine:3.17. Multiple fixed versions available.","status":"published","published":"2026-11-04T16:15:55Z","modified":"2026-11-04T17:16:12.08002394Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2026-80231","title":"CVE-2026-80231 in curl - Patched by Root","description":"Root has patched CVE-2026-80231 in the curl package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:40:45Z","modified":"2026-09-29T10:15:07.418924185Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-ALPINE-321-CVE-2026-80231","title":"CVE-2026-80231 in curl - Patched by Root","description":"Root has patched CVE-2026-80231 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.","status":"published","published":"2026-11-03T11:37:01Z","modified":"2026-11-03T12:15:03.350621607Z","updated_at":"2026-11-03T12:31:36.041963Z"},{"id":"ROOT-OS-ALPINE-322-CVE-2026-80231","title":"CVE-2026-80231 in curl - Patched by Root","description":"Root has patched CVE-2026-80231 in the curl package for Root:Alpine:3.22. Multiple fixed versions available.","status":"published","published":"2026-10-19T06:56:08Z","modified":"2026-10-19T07:15:05.958558212Z","updated_at":"2026-11-02T15:53:28.544053Z"}]}}