CVE-2026-107929
local interface connection reuse mixup
Project curl Security Advisory, October 14 2026 Permalink
VULNERABILITY
When CURLOPT_INTERFACE (or the command line tool's --interface option) is set with one of the documented prefixes (if!, host!, ifhost!), that binding is not part of the connection reuse key, so a later transfer asking for a
different source can silently reuse an existing connection and go out from the earlier transfer's source address
INFO
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-107929 to this issue.
CWE-488: Exposure of Data Element to Wrong Session
Severity: Low
This bug is not considered a C mistake (likely to have been avoided had we not been using C).
AFFECTED VERSIONS
- Affected versions: curl 8.9.0 to and including 8.22.0
- Not affected versions: curl < 8.9.0 and >= 8.23.0
- Not affected versions: curl >= 8.20.2 in the 8.20.X branch
- Not affected versions: curl >= 8.16.2 in the 8.16.X branch
- Not affected versions: curl >= 8.14.3 in the 8.14.X branch
- Introduced-in: https://github.com/curl/curl/commit/3060557af702dd59155e
libcurl is used by many applications, but not always advertised as such!
This flaw also affects the curl command line tool.
SOLUTION
RECOMMENDATIONS
A - Upgrade curl to version 8.23.0
B - Apply the patch to your local version
C - Avoid CURLOPT_INTERFACE and --interface
TIMELINE
This issue was reported to the curl project on October 9, 2026.
curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.
CREDITS
- Reported-by: Maksim Hayder
- Patched-by: Stefan Eissing
Thanks a lot!