CVE-2026-11564

CRITICAL 9.1

Native CA trust persist

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

CWE	CWE-295
Vendor	curl
Product	curl
Published	Jul 3, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for curl curl

Be the first to know when new critical vulnerabilities affecting curl curl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

curl / curl

8.17.0 < 8.20.1

curl / curl

eefd03c572996e5de4dec4fe295ad6f103e0eefc < d69bfad3fa3daf5e72331f6870667607828d5891

curl / curl

8.20.0 8.19.0 8.18.0 8.17.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

curl.se: https://curl.se/docs/CVE-2026-11564.json curl.se: https://curl.se/docs/CVE-2026-11564.html hackerone.com: https://hackerone.com/reports/3788984

Credits

Filipe Casal of Trail of Bits in collaboration with OpenAI Stefan Eissing