CVE-2026-80231

HIGH 7.5

native CA store conn reuse

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.

CWE	CWE-488
Vendor	curl
Product	curl
Published	Sep 6, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for curl curl

Be the first to know when new high vulnerabilities affecting curl curl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

curl / curl

7.71.0 < 8.14.2 8.15.0 < 8.16.1 8.17.0 < 8.20.1 8.21.0 < 8.22.0

curl / curl

148534db57dda611cf8516e92e4d6e35fc1e5074 < 7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42

curl / curl

8.21.0 8.20.0 8.19.0 8.18.0 8.17.0 8.16.0 8.15.0 8.14.1 8.14.0 8.13.0 8.12.1 8.12.0 8.11.1 8.11.0 8.10.1 8.10.0 8.9.1 8.9.0 8.8.0 8.7.1 8.7.0 8.6.0 8.5.0 8.4.0 8.3.0 8.2.1 8.2.0 8.1.2 8.1.1 8.1.0 8.0.1 8.0.0 7.88.1 7.88.0 7.87.0 7.86.0 7.85.0 7.84.0 7.83.1 7.83.0 7.82.0 7.81.0 7.80.0 7.79.1 7.79.0 7.78.0 7.77.0 7.76.1 7.76.0 7.75.0 7.74.0 7.73.0 7.72.0 7.71.1 7.71.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

curl.se: https://curl.se/docs/CVE-2026-80231.json curl.se: https://curl.se/docs/CVE-2026-80231.html hackerone.com: https://hackerone.com/reports/3969368

Credits

Stanislav Fort (Aisle Research) Daniel Stenberg