libcurl maintains a connection pool to reuse existing connections for subsequent transfers if the connection setup matches. However, this vulnerability arises because some TLS settings related to client certificates, particularly those involving the private key, are not included in the configuration match checks. As a result, libcurl may reuse a connection even when mTLS configuration options have changed in a way that should prevent reuse, potentially causing incorrect client authentication behavior.

The impact is that libcurl may reuse a TLS connection with outdated or incorrect client certificate configurations, which could lead to improper client authentication or session handling. No specific exploitation details or known exploits in the wild are reported. The vulnerability could affect applications relying on libcurl for secure client certificate authentication in TLS connections.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Users should monitor libcurl vendor advisories for updates and consider avoiding changing mTLS client certificate options on reused connections until a fix is available.