CVE-2026-80231 in libcurl
Summary
by MITRE • 09/06/2026
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/06/2026
The vulnerability identified within the libcurl library represents a critical failure in session management and cryptographic context isolation, specifically concerning the handling of HTTPS connections across varying security configurations. Libcurl is widely utilized as an open-source client-side URL transfer library that supports numerous protocols including HTTP, FTP, SMTP, and notably TLS/SSL for secure communications. The core issue arises from how libcurl manages connection pooling and reuse mechanisms when a user switches between different Certificate Authority (CA) store implementations during the lifecycle of a single curl handle or across sequential requests using shared state. Specifically, the flaw allows the library to incorrectly re-establish an existing HTTPS session with a remote server even after the application has explicitly changed its Native CA Store setting via the CURLSSLOPT_NATIVE_CA option. This behavior violates fundamental security principles regarding context isolation and trust validation, as it effectively bypasses intended changes in certificate verification policies without requiring a fresh TLS handshake that would enforce these new constraints.
From a technical perspective, this flaw stems from an insufficient check within libcurl's connection reuse logic. When establishing a secure connection, libraries often cache established sessions to improve performance by avoiding the computational overhead of repeated key exchanges and handshakes. However, security-critical parameters such as the CA store used for verifying server certificates must be part of the session identification criteria or explicitly validated before reusing an existing socket. In this case, libcurl fails to recognize that a change in the CURLSSLOPT_NATIVE_CA setting constitutes a significant alteration in the security context. Consequently, it proceeds to reuse a connection established under one CA trust model while applying configuration settings from another, potentially more restrictive or distinct trust store. This mismatch means that certificate validation may be performed against an outdated or incorrect set of root certificates, undermining the integrity of the authentication process and leaving the application vulnerable to man-in-the-middle attacks if the reused connection was not properly validated under the new security policy.
The operational impact of this vulnerability is severe for applications relying on libcurl for secure data transmission where dynamic configuration changes are common. Attackers could potentially exploit this flaw by manipulating network conditions or session states to force the reuse of a compromised or improperly verified connection. If an application switches from using system-native CA stores, which typically include trusted root certificates provided by operating systems and browsers, to a custom set of certificates or vice versa, it expects strict adherence to those specific trust anchors. The failure to enforce this switch allows for scenarios where malicious actors might present certificates signed by untrusted authorities that would have been rejected under the new configuration but are accepted due to the stale connection state. This undermines confidentiality and integrity guarantees, potentially leading to data exfiltration or injection of malicious content into secure channels without detection by standard certificate validation mechanisms.
This vulnerability aligns with CWE-295 Improper Certificate Validation, as it involves a failure in properly validating X.509 certificates against the intended trust store during connection establishment and reuse. Furthermore, from an adversarial perspective, this flaw facilitates MITM attacks consistent with ATT&CK technique T1078 Valid Accounts or more broadly T1496 Resource Hijacking if used to intercept traffic for subsequent exploitation. The lack of proper context switching in session management is a common pitfall in network libraries and highlights the necessity for rigorous state isolation when security parameters are modified at runtime.
To mitigate this risk, developers utilizing libcurl must ensure that any change to critical SSL/TLS configuration options triggers a complete reset of existing connections rather than allowing reuse. This can be achieved by explicitly closing all active handles or resetting the curl session before applying new CA store settings. Additionally, upgrading to patched versions of libcurl where this logic has been corrected is essential for long-term security posture. Security audits should focus on identifying code paths that modify SSL context parameters after initial connection setup and verify that these changes result in appropriate re-authentication sequences rather than silent state inheritance. Implementing strict session invalidation policies when trust anchors are altered ensures that the cryptographic handshake accurately reflects the current security requirements of the application, thereby preventing exploitation through stale or misconfigured connections.