CVE-2026-11564 Native CA trust persist
libcurl may incorrectly retain native CA trust when switching to custom CA material, allowing bypass of intended certificate validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-11564?
CVE-2026-11564 is a critical vulnerability in Haxx Curl, published on 3 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.
An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.
Weakness: CWE-295
Which versions are affected by CVE-2026-11564?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2026-11564?
Apply the vendor's patch.
Is CVE-2026-11564 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-11564 exists.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2026-11564, BELL-CVE-2026-11564, CURL-CVE-2026-11564, DEBIAN-CVE-2026-11564, GHSA-hf82-6jff-f22v, JLSEC-2026-1199 and 3 more.