CVE-2026-8932

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

• CWE-305

• https://curl.se/docs/CVE-2026-8932.htmlPatch, Vendor Advisory
• https://curl.se/docs/CVE-2026-8932.jsonVendor Advisory
• https://hackerone.com/reports/3733910Exploit, Issue Tracking, Third Party Advisory
• https://hackerone.com/reports/3733910Exploit, Issue Tracking, Third Party Advisory

Published

Jul 3, 2026

Last Modified

Sep 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89314`jwkFields.CheckConsistency` detected duplicate `key_ops` en…6.9
• CVE-2026-89315`JwtClaims.MarshalJSON` built a Go struct at runtime with `r…6.9
• CVE-2026-89316`LoadPublicKey` resolved an EC key's curve with an unchecked…6.3
• CVE-2026-89317gose parsed the JWS `crit` header into `JwsHeader.Crit` and …6.3
• CVE-2026-89318`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's …6.9
• CVE-2026-89319`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext le…6.3
• CVE-2026-89320`HmacShaCryptor.Hash` never hashed its input. For any input …8.8
• CVE-2026-89321Publishing limits the compressed size of a VSIX (ovsx.publis…4.3
• CVE-2026-89322Vault and Vault Enterprise did not consistently evaluate ACL…7.2
• CVE-2026-89324The Basel Post Types plugin for WordPress is vulnerable to A…9.8
• CVE-2026-89325An uncontrolled search path element in InsightVM assessment …7.8
• CVE-2026-89326Origin Validation Error vulnerability in Apache XML Graphics…