CVE-2026-82208 in libcurl
Summary
by MITRE • 09/06/2026
With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/06/2026
The vulnerability described involves a critical logic error in the TLS handshake process within libcurl when utilizing the wolfSSL backend with CA caching enabled. This flaw stems from an improper sequencing of trust anchor initialization during SSL context setup, leading to a state where previously cached certificate authorities override explicit user-defined security policies. The issue specifically manifests when an application employs the CURLOPT_SSL_CTX_FUNCTION callback mechanism to customize or replace the default trust store for outgoing connections. In this scenario, developers typically expect that any certificates added via the callback will constitute the sole set of trusted entities for the session, effectively replacing system defaults or previously cached roots. However, due to a race condition-like state management error in wolfSSL integration within libcurl, the library performs an additional step after the callback returns that re-applies the cached CA store. This action inadvertently merges or overwrites the custom trust configuration with the legacy cache, resulting in certificates that were explicitly rejected by the application's logic being silently reinstated as trusted entities.
From a technical perspective, this behavior violates the principle of least privilege and explicit intent in security configurations. When an application developer sets up a specific SSL context through a callback function, they are asserting control over which certificate authorities should be considered valid for that connection. The expected operational model is that the callback's modifications to the X509_STORE or equivalent structure persist until the session concludes. Instead, libcurl’s interaction with wolfSSL causes the internal caching mechanism to re-inject previously stored CA certificates into the active context after the custom logic has executed. This creates a discrepancy between the intended security posture and the actual runtime behavior. A certificate that is not present in the cached store but was intentionally omitted from the callback-selected store remains untrusted, yet if it exists within the cache, it gets re-added to the trust chain regardless of its absence in the current session's explicit configuration. This effectively nullifies any attempt by the application to restrict trust to a specific subset of authorities or to remove compromised roots dynamically during runtime.
The operational impact of this vulnerability is severe for applications that rely on dynamic certificate validation policies, such as those implementing Certificate Pinning or custom Root CA management in enterprise environments. An attacker who possesses a valid but unauthorized certificate signed by one of the cached CAs could potentially perform a Man-in-the-Middle attack against connections where the application intended to reject such certificates. For instance, if an organization has decommissioned a specific internal CA and removed it from their active trust store via callback logic, this flaw would allow any certificate issued by that deprecated CA to be accepted again during subsequent TLS handshakes. This undermines security controls designed to limit exposure to compromised or untrusted authorities, potentially leading to unauthorized access, data exfiltration, or session hijacking. The silent nature of the failure means that standard logging mechanisms may not immediately reveal why an unexpected certificate was accepted, complicating incident response and forensic analysis efforts for security teams monitoring TLS connections.
This vulnerability aligns with CWE-20 Improper Input Validation in terms of failing to correctly process the intended state of the trust store after external modification attempts. It also relates to CWE-697 Incorrect Comparison because the library fails to properly compare the final desired state against the actual applied state, allowing stale cached data to override current configuration. In the context of MITRE ATT&CK, this flaw facilitates lateral movement and credential access by undermining TLS mutual authentication or server certificate verification mechanisms that applications rely upon for secure communication channels. Attackers can exploit this misconfiguration to bypass application-level security controls without needing to compromise underlying infrastructure directly.
Mitigation strategies must address both immediate remediation and long-term architectural changes. The primary solution is to upgrade libcurl to a version where the wolfSSL backend’s CA caching logic has been corrected to respect the post-callback state of the SSL context. Developers should verify that their build environment links against patched libraries that ensure no re-application of cached stores occurs after custom callbacks execute. In environments where upgrading is not immediately feasible, workarounds include disabling CA caching entirely if performance impact is acceptable, or avoiding the use of CURLOPT_SSL_CTX_FUNCTION for trust store manipulation and instead relying on static configuration files or system-level trust stores that are managed outside the runtime callback lifecycle. Additionally, implementing strict certificate pinning at the application layer can provide a secondary defense mechanism, ensuring that even if the underlying TLS stack incorrectly accepts a cached CA, the application will still reject connections unless they present exactly the expected public key hash. Regular auditing of TLS configurations and monitoring for unexpected certificate acceptance events are also recommended to detect potential exploitation attempts in real-time.