CVE-2026-80231

HighCVSS 7.5/10Last modified Sep 15, 2026

Description

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-488

Affected software

Vendor	Product	Versions
curl	curl	>= 7.71.0, < 8.14.2; >= 8.15.0, < 8.16.1; >= 8.17.0, < 8.20.1; >= 8.21.0, < 8.22.0
curl	curl	>= 148534db57dda611cf8516e92e4d6e35fc1e5074, < 7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42
curl	curl	8.21.0; 8.20.0; 8.19.0; 8.18.0; 8.17.0; 8.16.0; 8.15.0; 8.14.1; 8.14.0; 8.13.0; 8.12.1; 8.12.0; 8.11.1; 8.11.0; 8.10.1; 8.10.0; 8.9.1; 8.9.0; 8.8.0; 8.7.1

References

https://curl.se/docs/CVE-2026-80231.htmlMitigation, Patch, Vendor Advisory
https://curl.se/docs/CVE-2026-80231.jsonVendor Advisory
https://hackerone.com/reports/3969368Exploit, Mitigation, Third Party Advisory
https://hackerone.com/reports/3969368Exploit, Mitigation, Third Party Advisory

Timeline

Published: Sep 6, 2026
Last modified: Sep 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-802337.2CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote a CVE-2026-802345.3CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obta CVE-2026-802359.8EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and CVE-2026-802368.2Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload CVE-2026-802378.8EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and e CVE-2026-802389.3Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Un CVE-2026-802392.4Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensi CVE-2026-80249.8A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoordinator to gain full CVE-2026-80259.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in MOSK Information Technologies Ltd. CBS CVE-2026-802537.0An improper physical access control issue exists in ShizenBox2 (dev-conf). If exploited, an attacker with physical access to the product may CVE-2026-802547.1Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If exploited, an attacker who can log in to the prod CVE-2026-802557.5A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute c