--- id: CVE-2026-8286 title: |- A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not. summary: |- A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not. severity: high cvss: 8.1 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N' cwe: - CWE-295 vendor: haxx product: curl affected: - 'curl >= 7.30.0, < 8.21.0' patched: - curl 8.21.0 published: '2026-07-03' updated: '2026-09-15' sourceUpdated: '2026-09-15T07:16:31.617' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8286' references: - url: 'https://curl.se/docs/CVE-2026-8286.html' label: 2499f714-1537-4658-8207-48ae4bb9eae9 - url: 'https://curl.se/docs/CVE-2026-8286.json' label: 2499f714-1537-4658-8207-48ae4bb9eae9 - url: 'https://hackerone.com/reports/3718195' label: 2499f714-1537-4658-8207-48ae4bb9eae9 - url: 'https://hackerone.com/reports/3718195' label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8286.json - url: 'https://access.redhat.com/security/cve/CVE-2026-8286' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2496763' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-8286' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8286' - url: 'https://access.redhat.com/errata/RHSA-2026:60440' - url: 'https://access.redhat.com/errata/RHSA-2026:55450' - url: 'https://access.redhat.com/errata/RHSA-2026:55439' - url: 'https://access.redhat.com/errata/RHSA-2026:57462' - url: 'https://access.redhat.com/errata/RHSA-2026:63140' - url: 'https://access.redhat.com/errata/RHSA-2026:63135' - url: 'https://access.redhat.com/errata/RHSA-2026:63138' - url: 'https://access.redhat.com/errata/RHSA-2026:61783' - url: 'https://access.redhat.com/errata/RHSA-2026:29017' - url: 'https://access.redhat.com/errata/RHSA-2026:34975' - url: 'https://access.redhat.com/errata/RHSA-2026:56869' - url: 'https://access.redhat.com/errata/RHSA-2026:62260' - url: 'https://access.redhat.com/errata/RHSA-2026:58981' - url: 'https://access.redhat.com/errata/RHSA-2026:66018' - url: 'https://access.redhat.com/errata/RHSA-2026:66357' tags: - nvd - cve.org - exploit-available - csaf - vex - red-hat exploitAvailable: true ssvc: exploitation: poc automatable: 'no' technicalImpact: total timestamp: '2026-07-06T17:33:16.174641Z' epss: 0.00309 epssPercentile: 0.23993 ingestedAt: '2026-07-04T04:55:39.432Z' --- ## Overview A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not. ## Affected - `curl >= 7.30.0, < 8.21.0` ## Remediation Upgrade past the affected range: - `curl 8.21.0` ## Vendor advisories - **RHSA-2026:60440** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60440) - **RHSA-2026:55450** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55450) - **RHSA-2026:55439** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55439) - **RHSA-2026:57462** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8) · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57462) - **RHSA-2026:63140** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63140) - **RHSA-2026:63135** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63135) - **RHSA-2026:63138** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63138) - **RHSA-2026:61783** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61783) - **RHSA-2026:29017** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:29017) - **RHSA-2026:34975** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:34975) - **RHSA-2026:56869** · Red Hat · fixed in: Red Hat JBoss Core Services 2.4.62.SP5 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:56869) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8286.json) - **RHSA-2026:66357** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66357)