curl / Docs / curl CVEs / wolfSSL CA-cache hit overrides callback
Related:
Audits
Changelog
curl CVEs
JSON metadata
Original report
Vulnerability Disclosure
Vulnerabilities Table

CVE-2026-82208

wolfSSL CA-cache hit overrides callback

Project curl Security Advisory, September 2 2026 Permalink

VULNERABILITY

With the wolfSSL backend, when CA caching is enabled and an CURLOPT_SSL_CTX_FUNCTION callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.

INFO

This problem only exists when curl is built to use the wolfSSL TLS backend.

This bug is not considered a C mistake (likely to have been avoided had we not been using C).

This flaw does not affect the curl command line tool.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-82208 to this issue.

CWE-295: Improper Certificate Validation

Severity: Low

AFFECTED VERSIONS

SOLUTION

RECOMMENDATIONS

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade curl and libcurl to version 8.22.0

B - Apply the patch to your version and rebuild

C - Avoid using CURLOPT_SSL_CTX_FUNCTION with the wolfSSL backend

TIMELINE

This issue was reported to the curl project on August 27, 2026.

curl 8.22.0 was released on September 2 2026, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!