This vulnerability occurs when libcurl performs a second transfer to the same hostname over HTTP/3 using a cached SSL session and early data enabled. If the original legitimate server is replaced by an attacker’s impostor machine lacking a valid certificate, libcurl might send the second request's data immediately upon connection before enforcing certificate verification failure. This premature data transmission can lead to leakage of sensitive information to an attacker-controlled server.

Sensitive information may be leaked to an attacker impersonating the server if libcurl sends early data before verifying the server's certificate on a reused SSL session. This could expose confidential data transmitted in the early data phase of the TLS handshake.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling SSL session caching (`CURLOPT_SSL_SESSIONID_CACHE`) or disabling early data (`CURLSSLOPT_EARLYDATA`) in libcurl to prevent premature data transmission.