---
id: CVE-2026-11564
title: |-
  libcurl keeps previously used connections in a connection pool for subsequent
  transfers to reuse if one of them matches the setup.

  An easy handle that first uses default native CA trust can continue trusting
  the native platform store af…
summary: |-
  libcurl keeps previously used connections in a connection pool for subsequent
  transfers to reuse if one of them matches the setup.

  An easy handle that first uses default native CA trust can continue trusting
  the native platform store af…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-295
vendor: haxx
product: curl
affected:
  - 'curl >= 8.17.0, < 8.21.0'
patched:
  - curl 8.21.0
published: '2026-07-03'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T07:16:25.530'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-11564'
references:
  - url: 'https://curl.se/docs/CVE-2026-11564.html'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://curl.se/docs/CVE-2026-11564.json'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/3788984'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/3788984'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-07-06T17:09:36.356822Z'
epss: 0.00428
epssPercentile: 0.34376
ingestedAt: '2026-07-04T04:55:39.413Z'
---

## Overview

libcurl keeps previously used connections in a connection pool for subsequent
transfers to reuse if one of them matches the setup.

An easy handle that first uses default native CA trust can continue trusting
the native platform store after the application switches that same handle to
custom CA material for a later transfer.

## Affected

- `curl >= 8.17.0, < 8.21.0`

## Remediation

Upgrade past the affected range:

- `curl 8.21.0`