CVE-2026-107929None▾ SunlitWhen `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a dif…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
When CURLOPT_INTERFACE (or the command line tool's --interface option) is
set with one of the documented prefixes (if!, host!, ifhost!), that
binding is not part of the connection reuse key, so a later transfer asking
for a different source can silently reuse an existing connection and go out
from the earlier transfer's source address
curl >= 8.22.0 <= 8.22.0curl >= 8.21.0 <= 8.21.0curl >= 8.20.0 <= 8.20.0curl >= 8.19.0 <= 8.19.0curl >= 8.18.0 <= 8.18.0curl >= 8.17.0 <= 8.17.0curl >= 8.16.0 <= 8.16.0curl >= 8.15.0 <= 8.15.0curl >= 8.14.1 <= 8.14.1curl >= 8.14.0 <= 8.14.0curl >= 8.13.0 <= 8.13.0curl >= 8.12.1 <= 8.12.1curl >= 8.12.0 <= 8.12.0curl >= 8.11.1 <= 8.11.1curl >= 8.11.0 <= 8.11.0curl >= 8.10.1 <= 8.10.1curl >= 8.10.0 <= 8.10.0curl >= 8.9.1 <= 8.9.1curl >= 8.9.0 <= 8.9.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86411NoneFTP connection reuse inherits client-certificate
CVE-2026-5773High· 7.5libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connectio…
CVE-2026-5545Medium· 6.5libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that sub…
CVE-2026-80231High· 7.5A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.
CVE-2026-19931Critical· 9.8A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials
CVE-2026-8458Medium· 6.5libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests …