CVE-2026-80231
native CA store conn reuse
Project curl Security Advisory, September 2 2026 Permalink
VULNERABILITY
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (CURLSSLOPT_NATIVE_CA) than when the connection was created.
INFO
This bug exists only on Windows and macOS.
This bug is not considered a C mistake (likely to have been avoided had we not been using C).
This flaw also affects the curl command line tool.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-80231 to this issue.
CWE-488: Exposure of Data Element to Wrong Session
Severity: Low
AFFECTED VERSIONS
- Affected versions: curl 7.71.0 to and including 8.21.0
- Not affected versions: curl < 7.71.0 and >= 8.22.0
- Introduced-in: https://github.com/curl/curl/148534db57dda611cf8516e9
SOLUTION
RECOMMENDATIONS
We suggest you take one of the following actions immediately, in order of preference:
A - Upgrade curl and libcurl to version 8.22.0
B - Apply the patch to your version and rebuild
C - Enable CURLOPT_FORBID_REUSE for transfers using the native CA store.
TIMELINE
This issue was reported to the curl project on August 24, 2026.
curl 8.22.0 was released on September 2 2026, coordinated with the publication of this advisory.
CREDITS
- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Daniel Stenberg
Thanks a lot!