CURL-CVE-2026-107929

See a problem?
Please try reporting it to the source first.
Source
https://curl.se/docs/CVE-2026-107929.html
Import Source
https://curl.se/docs/CURL-CVE-2026-107929.json
JSON Data
https://api.osv.dev/v1/vulns/CURL-CVE-2026-107929
Aliases
  • CVE-2026-107929
Published
2026-10-14T08:00:00Z
Modified
2026-10-14T19:02:57Z
Summary
local interface connection reuse mixup
Details

When CURLOPT_INTERFACE (or the command line tool's --interface option) is set with one of the documented prefixes (if!, host!, ifhost!), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address

Database specific 
{
    "CWE":  {
        "desc":  "Exposure of Data Element to Wrong Session",
        "id":  "CWE-488"
    },
    "URL":  "https://curl.se/docs/CVE-2026-107929.json",
    "affects":  "both",
    "issue":  "https://hackerone.com/reports/4099618",
    "last_affected":  "8.22.0",
    "package":  "curl",
    "severity":  "Low",
    "www":  "https://curl.se/docs/CVE-2026-107929.html"
}
Credits
    • Maksim Hayder - FINDER
    • Stefan Eissing - REMEDIATION_DEVELOPER

Affected packages

Git / github.com/curl/curl.git

Affected ranges

Type
SEMVER
Events
Introduced
8.9.0
Fixed
8.14.3
Introduced
8.15.0
Fixed
8.16.2
Introduced
8.17.0
Fixed
8.20.2
Introduced
8.21.0
Fixed
8.23.0
Type
GIT
Repo
https://github.com/curl/curl.git
Events
Introduced
3060557af702dd59155ea703a0790455c2f49a59
Fixed
d37d79df1e01066417aff0a9e6bc675edad3edba

Affected versions

8.*
8.10.0
8.10.1
8.11.0
8.11.1
8.12.0
8.12.1
8.13.0
8.14.0
8.14.1
8.15.0
8.16.0
8.17.0
8.18.0
8.19.0
8.20.0
8.21.0
8.22.0
8.9.0
8.9.1
Other
curl-8_10_0
curl-8_10_1
curl-8_11_0
curl-8_11_1
curl-8_12_0
curl-8_12_1
curl-8_13_0
curl-8_14_0
curl-8_14_1
curl-8_15_0
curl-8_16_0
curl-8_17_0
curl-8_18_0
curl-8_19_0
curl-8_20_0
curl-8_21_0
curl-8_22_0
curl-8_9_0
curl-8_9_1
rc-8_18_0-1
rc-8_18_0-2
rc-8_18_0-3
rc-8_19_0-1
rc-8_19_0-2
rc-8_19_0-3
rc-8_20_0-1
rc-8_20_0-2
rc-8_20_0-3
rc-8_21_0-1
rc-8_21_0-2
rc-8_21_0-3
rc-8_22_0-1
rc-8_22_0-2
rc-8_22_0-3
rc-8_23_0-1
rc-8_23_0-2
rc-8_23_0-3

Database specific

source 
"https://curl.se/docs/CURL-CVE-2026-107929.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "33020138232155442830075670003334574911",
                "284496318731629087141625997780098648157",
                "303810388758707012354860312689069220902",
                "297991860763815203074504086583422266007",
                "320738731781992127111231261139417733998",
                "183355512448777274762417343089455919698",
                "327037773882404803493005135630719992721",
                "336816732232193545647996595725117146784",
                "333922100016805542905735223533904565279",
                "302161740985268037992741830546816892734",
                "152565993869504700647831362893325960965",
                "236785012361113850722983374919551400303",
                "250990469105218562137812073281062396809",
                "265055169885016502813618027537581269531",
                "335093259878661112883911847880410867294",
                "270151552962586029188134749841005948407",
                "319365032065212819612558915299481130884",
                "245225474651377462538439534491557631839",
                "13766214190832539937349899346812664422",
                "139910345167148674428191338879273283076",
                "27105961946935237132347203899648593673",
                "160143544109260659576718363567253889129",
                "155942508610337650375829391273276518620",
                "54014406768191730793879183146276455395",
                "7579389191057427449223444008431806377",
                "268998884163826117524530243890700983193"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-107929-06a47425",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba",
        "target":  {
            "file":  "lib/setopt.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "154092934692214753891100031030585287566",
            "length":  4615
        },
        "id":  "CURL-CVE-2026-107929-11f7cbe3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba",
        "target":  {
            "file":  "lib/cf-socket.c",
            "function":  "bindlocal"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "216311387717917335966008888650279651201",
            "length":  727
        },
        "id":  "CURL-CVE-2026-107929-57281d70",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba",
        "target":  {
            "file":  "lib/url.c",
            "function":  "url_match_connect_config"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "241761572520213555815986056258028473518",
                "163601861664714743800796619752796183035",
                "301086512416807435301410295087456542065",
                "201061082653926972482711153051397625531",
                "155772763066964582268942135830122181461",
                "236760497796532790112481304454223766281",
                "78229127818962189212955549976780213979",
                "319225037750470863747197998147443682305",
                "237424357299181299228072909154614780340",
                "138705466990541979074338740716845372091"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-107929-6c03fe0e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba",
        "target":  {
            "file":  "lib/urldata.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "292477562089670203546715531281855032631",
            "length":  966
        },
        "id":  "CURL-CVE-2026-107929-764f72b0",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba",
        "target":  {
            "file":  "lib/url.c",
            "function":  "Curl_conn_free"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "295471359500447413983506171453182920072",
                "102537179141412352703412724965194714124",
                "253065603714626584192827515944205048613",
                "53086521482358518454694277165161113997",
                "278883379426524064491317862448381897927",
                "78574684170504972670587354460513098254",
                "31943940246699968108493056152378679547",
                "5083707108630385855929631925951027747",
                "46059668823259700362759565207716767937",
                "178394624426392169185063832772425982707",
                "247502614701560520177589191552868473704",
                "279118966899911942467357341576905317302",
                "195846308979971471901981500488563296077",
                "18855817798437235251451650598114305082",
                "105864727788617692189089432493518387072",
                "31703315142492533254074442015070059561",
                "152202466067929385653533129649295176440",
                "182980106233807485102192909226238534403",
                "157135655820733821835811366814926919691",
                "94809630114563572021978955989229958217",
                "134293798001907610396521083790962910417",
                "222282469926179157414751087589579001064"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-107929-88e71522",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba",
        "target":  {
            "file":  "lib/url.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "259011240289427334554940194434727253752",
            "length":  1493
        },
        "id":  "CURL-CVE-2026-107929-8af31516",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba",
        "target":  {
            "file":  "lib/cf-socket.c",
            "function":  "Curl_parse_interface"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "165700183563521820635241199037808038496",
            "length":  521
        },
        "id":  "CURL-CVE-2026-107929-9d3b2b76",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba",
        "target":  {
            "file":  "lib/setopt.c",
            "function":  "setstropt_interface"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "240965199293963040657462781825043274306",
                "325946073268998296221267341170805573275",
                "161640061417606002698681785146929937703",
                "302839495064354881349821188927915667033",
                "133954066936573215356027271573791408778",
                "247165320603286810793565282486563192110",
                "193256390999540614316227033904785474945",
                "221532175889607628411783885514768542636",
                "305499140329563737444338400601966151175",
                "68398906592569300523369606696890784028",
                "323911849138958289925609114626597167039",
                "282380787767237373395857515020191908688",
                "297359965580113738310417812189274657403",
                "93092124178344738472206795528813125936",
                "267904494059351927795816571766463726891",
                "139633433816409880911503739064410014726",
                "297669038191481671044558879282196738757",
                "243464594113434836304316827964548995145",
                "60782010540698563080804620860495232373",
                "73485865333706556177611286645421320657",
                "181675481760836591809191026820394747412",
                "4379488974094506383523559080089570242",
                "164445395282578676102034586715499167552",
                "296799701481345743179792304784711596759",
                "328866562827620159195538597322521034853",
                "251348661015263466825783410069892031209",
                "225958704073314054748635651367767469767",
                "87424921850342866959386140772178402666",
                "328378543984623678754276527871924028783",
                "108392085691230563096297613224863266416",
                "260484233268280570360266982796410344517",
                "81144316950926554740167604411882240748",
                "216534967855080800143571935888272382802",
                "131479412399064995761000322462446049332",
                "205155597383629923149822363046429740394",
                "226908033118161122998475485214091309012",
                "329585480246353887087574658262478055667",
                "86287363936475492143279473303486072945",
                "77530511929617101001688490542174612989",
                "130344516320563162856213914607584114373",
                "123871891556393757966698575664914084200",
                "175200032352015712574574421417429878058",
                "88094472011592327144519716919150536954",
                "173827880235007152714631447574692914419",
                "227436730230839496667790906781429370129",
                "108006597334242478313557223431739697659",
                "61980273567006545651731772684002951391",
                "13240688382365622586288418068378469987",
                "316506885062440248980792724615890302520",
                "230734042705755621630983839206833912944",
                "257990234214385080086986174134158743012",
                "13841977920785428109069930956932320339",
                "13126770451193411558462605900882930669",
                "61404804460176638403567844897469869080",
                "204477106088722445423057627436981623600",
                "224458961571057888218669460028722634234",
                "66884575245799898823099320101937911553",
                "18676836453661791843188957757166144922",
                "90603538492438094044997283166823009211",
                "230363972447557415589848012455996039702",
                "218705691217539404203348162030099689111",
                "242110244547041355669995072849744603713",
                "183242829559431050036314163991987214339",
                "213366377822931337695804678205370584301",
                "233102408512923946390527938234531064215",
                "282254455405980793091468143226823127362",
                "292219757685419083600378378185994508696",
                "115080839958162681641791987847338172872",
                "271657245486746252440671206474324619777",
                "12961135213277731284337566419443870927",
                "313541043695844769309535327302849569637",
                "254851863711351280563415993925122047197",
                "294641844104989860485448518050397627832",
                "276484725839215918772713873147010969712",
                "130008688414223729511610950920983849316",
                "28706223577252231616883296606693092602",
                "214424515885556204186388673530628488015",
                "309770038588769846483834314765726733591",
                "284874780514674249735921665945783324967",
                "315673732513036155195697754996243388216",
                "78189467574956907167535925279231244801",
                "258776238864208222802197637724472373701",
                "20149792378438124116137036878508576402",
                "150914943872853674225484912607704914456",
                "4648763021237051344160136121637827990",
                "153302099546013622130040335922316018833",
                "268847273557575212523935400498590267978",
                "255425651120485246257885565001746249887",
                "291160749033063950786255850808463788473",
                "209319521664839668822041326635017859859",
                "117262052801663669835939155996964377440",
                "15772031990569790513939502773343419517",
                "215296571844817188613113380136167484607",
                "325650273960132007881864488802978436441",
                "326998349713637031499113786754324545391",
                "24142217891431779001139407516608752817",
                "197071279266064039427863835565027900782",
                "125526119893853453765621831925435275622",
                "306322138103110709169461979850860440589",
                "224811516342675137510813567804098665487",
                "271819307446197735239396915170518896475",
                "135627799642184460457027255500473805720",
                "332754287052043346141988755639860121150",
                "199888541337461908393945277351767808659",
                "300912636596397938197826700491996001564",
                "252855987410619850217753075063122157977",
                "289991005256100515723801876537193353444",
                "310406779611750798457867550648759612662",
                "28215562786753059694742451789353523209",
                "85763879348970170860407938759684388517",
                "247895283437076443659319112739469569610",
                "188563272038283577540947493690691292708"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-107929-d04bac37",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba",
        "target":  {
            "file":  "lib/cf-socket.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "195391317365540274191655587606053165838",
            "length":  1374
        },
        "id":  "CURL-CVE-2026-107929-ef5644c6",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba",
        "target":  {
            "file":  "lib/url.c",
            "function":  "allocate_conn"
        }
    }
]
vanir_signatures_modified 
"2026-10-14T19:02:57Z"