curl / Docs / curl CVEs / auto client cert connection reuse mixup
Related:
Audits
Changelog
curl CVEs
JSON metadata
Original report
Vulnerability Disclosure
Vulnerabilities Table

CVE-2026-86415

auto client cert connection reuse mixup

Project curl Security Advisory, October 14 2026 Permalink

VULNERABILITY

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.

INFO

This flaw only affects curl builds using Schannel, which is a TLS backend only available on Windows.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-86415 to this issue.

CWE-201: Information Exposure Through Sent Data

Severity: Low

AFFECTED VERSIONS

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION

RECOMMENDATIONS

A - Upgrade curl to version 8.23.0

B - Apply the patch to your local version

C - Build curl with a different TLS backend

TIMELINE

This issue was reported to the curl project on September 3, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!