The curl project released an update fixing 18 vulnerabilities, including one introduced in version 7.7 from 2001 (CVE-2026-8932), which allows libcurl to reuse an existing connection even after client certificate or private key settings change, potentially enabling authentication bypass. Other fixed issues include credential confusion (CVE-2026-8926), double-free (CVE-2026-8925), use-after-free (CVE-2026-9080, CVE-2026-10536), and improper host validation (CVE-2026-9547). These vulnerabilities affect libcurl applications but not the curl command-line tool. The vulnerabilities were discovered through community efforts and AI-assisted analysis. Despite the widespread use of curl across billions of devices, no in-the-wild exploitation has been reported.

The vulnerabilities could allow an attacker to bypass authentication via mTLS connection reuse, cause memory corruption issues such as double-free and use-after-free, and potentially cause improper host validation. These flaws affect libcurl applications and could undermine the security of data transfers relying on libcurl. However, there are no known exploits in the wild, and the curl command-line tool is not affected by the mTLS connection reuse issue.

A patch is available in the latest curl release that addresses these vulnerabilities. Users and developers should update libcurl to the newest version to mitigate these issues. Since the curl project has released an official fix, applying this update is the recommended remediation. No additional mitigation steps are indicated by the vendor advisory.