CVE-2026-8286 wrong STARTTLS connection reuse
Attackers can bypass TLS security checks by forcing curl to reuse a connection with mismatched TLS configurations during STARTTLS upgrades.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8286?
CVE-2026-8286 is a high-severity vulnerability in Haxx Curl, published on 3 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.
Weakness: CWE-295
Which versions are affected by CVE-2026-8286?
It affects 1 product.
Linux distribution packages (14)
curl AlmaLinux:8 | All versions | 7.61.1-34.el8_10.13 |
libcurl AlmaLinux:8 | All versions | 7.61.1-34.el8_10.13 |
libcurl-devel AlmaLinux:8 | All versions | 7.61.1-34.el8_10.13 |
libcurl-minimal AlmaLinux:8 | All versions | 7.61.1-34.el8_10.13 |
curl Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.13 |
curl-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.13 |
curl-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.13 |
curl-minimal-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.13 |
libcurl Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.13 |
libcurl-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.13 |
libcurl-devel Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.13 |
libcurl-minimal Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.13 |
libcurl-minimal-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.13 |
curl Rocky Linux:8 | All versions | 0:7.61.1-34.el8_10.13 |
Products include Haxx Curl.
How do I fix CVE-2026-8286?
Upgrade to a fixed version.
Is CVE-2026-8286 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-8286 exists.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2026-8286, ALSA-2026:57462, AZL-91815, AZL-91842, BELL-CVE-2026-8286, CLSA-2026-1785319688 and 23 more.