CVE-2026-8932

HighCVSS 7.5/10Last modified Sep 15, 2026

Description

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-305

Affected software

No affected versions have been published.

Timeline

Published
Jul 3, 2026
Last modified
Sep 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-893208.8`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AESCVE-2026-893214.3Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entryCVE-2026-893227.2Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may alloCVE-2026-893249.8The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerabiliCVE-2026-893257.8An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user tCVE-2026-89326Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocoCVE-2026-893273.8The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attribuCVE-2026-893283.8The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing severCVE-2026-893296.2A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by senCVE-2026-89337.8A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to cCVE-2026-893306.1The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulneraCVE-2026-893315.3The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board featur