When CURLOPT_INTERFACE (or the command line tool's --interface option) is set with one of the documented prefixes (if!, host!, ifhost!), that… (CVE-2026-107929)

CVE-2026-107929 describes a flaw in the connection reuse logic of software using CURLOPT_INTERFACE or the equivalent command line option. When the interface is specified with documented prefixes such as if!, host!, or ifhost!, the binding is omitted from the connection reuse key. This omission causes subsequent transfers that specify a different source interface to silently reuse an existing connection established with a different source address, potentially causing traffic to originate from an unintended source interface.

The vulnerability can cause network traffic to be sent from an unintended source interface due to connection reuse ignoring the interface binding. This may lead to unexpected network behavior or policy violations if different source interfaces are expected to segregate traffic. No direct exploitation or active attacks are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid setting CURLOPT_INTERFACE or the --interface option with the documented prefixes if! , host! , or ifhost! in scenarios where source interface binding is critical. Monitor vendor communications for updates.