CVE-2026-8932 incomplete mTLS config matching in conn reuse
libcurl may reuse connections despite changed mTLS client certificate settings, potentially bypassing mutual TLS authentication requirements.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8932?
CVE-2026-8932 is a high-severity vulnerability in Haxx Curl, published on 3 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.
Weakness: CWE-305
Which versions are affected by CVE-2026-8932?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2026-8932?
Upgrade to a fixed version.
Is CVE-2026-8932 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-8932 exists.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2026-8932, AZL-91797, AZL-91827, BELL-CVE-2026-8932, CLSA-2026-1786007050, CLSA-2026-1786034027 and 27 more.