libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. (CVE-2026-8932)
A vulnerability in libcurl causes it to reuse previously created connections even when certain mutual TLS (mTLS) configuration options related to client certificates have changed, which should prevent reuse. This flaw can lead to the wrong client certificates being used during TLS connections. The issue affects multiple versions of curl, including various Ubuntu package versions. Fixes have been released and are available through standard system updates or Ubuntu Pro for extended support releases.
AI Analysis
Technical Summary
libcurl maintains a connection pool to reuse existing connections for subsequent transfers if the setup matches. However, some TLS settings related to client certificates, particularly options involving the private key, were not included in the configuration match checks. This omission caused libcurl to reuse connections even when mTLS-related options changed, potentially resulting in the use of incorrect client certificates. The vulnerability is identified as CVE-2026-8932 and affects numerous curl versions, including those packaged in Ubuntu releases. The issue has been addressed in updated package versions provided by Ubuntu.
Potential Impact
The vulnerability could cause libcurl to use incorrect client certificates when reusing connections, potentially exposing sensitive information or causing authentication errors. The CVSS score is 7.5 (high impact on integrity), indicating a significant risk of improper client certificate usage. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available and should be applied by updating curl and libcurl packages to the patched versions provided by Ubuntu. For Ubuntu 22.04 LTS, 20.04 LTS, and 18.04 LTS, standard system updates or Ubuntu Pro updates include the necessary patches. Users should ensure their systems are updated to the specified fixed package versions to remediate this vulnerability.
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. (CVE-2026-8932)
Description
A vulnerability in libcurl causes it to reuse previously created connections even when certain mutual TLS (mTLS) configuration options related to client certificates have changed, which should prevent reuse. This flaw can lead to the wrong client certificates being used during TLS connections. The issue affects multiple versions of curl, including various Ubuntu package versions. Fixes have been released and are available through standard system updates or Ubuntu Pro for extended support releases.
CVSS v3.1
Score 7.5high
Affected software
pkg:deb/ubuntu/curl?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/curl?arch=source&distro=esm-infra-legacy/xenialpkg:deb/ubuntu/curl?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/curl?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/curl?arch=source&distro=jammypkg:deb/ubuntu/curl?arch=source&distro=noblepkg:deb/ubuntu/curl?arch=source&distro=questingpkg:deb/ubuntu/curl?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
libcurl maintains a connection pool to reuse existing connections for subsequent transfers if the setup matches. However, some TLS settings related to client certificates, particularly options involving the private key, were not included in the configuration match checks. This omission caused libcurl to reuse connections even when mTLS-related options changed, potentially resulting in the use of incorrect client certificates. The vulnerability is identified as CVE-2026-8932 and affects numerous curl versions, including those packaged in Ubuntu releases. The issue has been addressed in updated package versions provided by Ubuntu.
Potential Impact
The vulnerability could cause libcurl to use incorrect client certificates when reusing connections, potentially exposing sensitive information or causing authentication errors. The CVSS score is 7.5 (high impact on integrity), indicating a significant risk of improper client certificate usage. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available and should be applied by updating curl and libcurl packages to the patched versions provided by Ubuntu. For Ubuntu 22.04 LTS, 20.04 LTS, and 18.04 LTS, standard system updates or Ubuntu Pro updates include the necessary patches. Users should ensure their systems are updated to the specified fixed package versions to remediate this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-m7xm-hf59-w6rj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-8932"]
- Cvss Version
- 3.1
Threat ID: 6a483cb427e9c79719d81f59
Added to database: 07/03/2026, 22:50:28 UTC
Last enriched: 09/29/2026, 05:32:35 UTC
Last updated: 10/02/2026, 14:46:12 UTC
Views: 78
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.