CURL-CVE-2026-82208

See a problem?
Please try reporting it to the source first.
Source
https://curl.se/docs/CVE-2026-82208.html
Import Source
https://curl.se/docs/CURL-CVE-2026-82208.json
JSON Data
https://api.osv.dev/v1/vulns/CURL-CVE-2026-82208
Aliases
  • CVE-2026-82208
Published
2026-09-02T08:00:00Z
Modified
2026-09-03T02:01:57.205107Z
Summary
wolfSSL CA-cache hit overrides callback
Details

With the wolfSSL backend, when CA caching is enabled and an CURLOPT_SSL_CTX_FUNCTION callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.

Database specific 
{
    "URL": "https://curl.se/docs/CVE-2026-82208.json",
    "CWE": {
        "desc": "Improper Certificate Validation",
        "id": "CWE-295"
    },
    "package": "curl",
    "affects": "lib",
    "last_affected": "8.21.0",
    "www": "https://curl.se/docs/CVE-2026-82208.html",
    "severity": "Low",
    "issue": "https://hackerone.com/reports/3973090"
}
References
Credits
    • Stanislav Fort (Aisle Research) - FINDER
    • Stefan Eissing - REMEDIATION_DEVELOPER

Affected packages

Git / github.com/curl/curl.git

Affected ranges

Type
SEMVER
Events
Introduced
8.9.1
Fixed
8.22.0
Type
GIT
Repo
https://github.com/curl/curl.git
Events
Introduced
0f2876b2c33f6784a27b6f7345bd8cd95b46352a
Fixed
ed0338befd1d865a8ea1fbaa90013a096dedd07a

Affected versions

8.*
8.10.0
8.10.1
8.11.0
8.11.1
8.12.0
8.12.1
8.13.0
8.14.0
8.14.1
8.15.0
8.16.0
8.17.0
8.18.0
8.19.0
8.20.0
8.21.0
8.9.1
Other
curl-8_10_0
curl-8_10_1
curl-8_11_0
curl-8_11_1
curl-8_12_0
curl-8_12_1
curl-8_13_0
curl-8_14_0
curl-8_14_1
curl-8_15_0
curl-8_16_0
curl-8_17_0
curl-8_18_0
curl-8_19_0
curl-8_20_0
curl-8_21_0
curl-8_9_1
rc-8_18_0-1
rc-8_18_0-2
rc-8_18_0-3
rc-8_19_0-1
rc-8_19_0-2
rc-8_19_0-3
rc-8_20_0-1
rc-8_20_0-2
rc-8_20_0-3
rc-8_21_0-1
rc-8_21_0-2
rc-8_21_0-3
rc-8_22_0-1
rc-8_22_0-2
rc-8_22_0-3

Database specific

vanir_signatures 
[
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "3923404689551009163607441279828111175",
                "297624718997870639840150836257476086448",
                "56205908250059361441879990564662064602",
                "85439685350400643831478693185264849405",
                "206455418915853995366232742870540736875",
                "308268091786777598060810704004673016972",
                "317513464329706427293671634178034016553",
                "69518472294264634418027510581645809159",
                "72674729481011985343164199229800799409",
                "194300608716949252276030240923330874213",
                "81827856355291595232907156722595705799"
            ],
            "threshold": 0.9
        },
        "id": "CURL-CVE-2026-82208-004be86c",
        "target": {
            "file": "lib/vtls/wolfssl.c"
        },
        "source": "https://github.com/curl/curl.git/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 1763.0,
            "function_hash": "39676463464626033682420662062357537373"
        },
        "id": "CURL-CVE-2026-82208-790f655b",
        "target": {
            "function": "wssl_init_ech",
            "file": "lib/vtls/wolfssl.c"
        },
        "source": "https://github.com/curl/curl.git/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 2147.0,
            "function_hash": "1807422166572413733492374297762200315"
        },
        "id": "CURL-CVE-2026-82208-9159197f",
        "target": {
            "function": "wssl_populate_x509_store",
            "file": "lib/vtls/wolfssl.c"
        },
        "source": "https://github.com/curl/curl.git/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 973.0,
            "function_hash": "128549031654971917451338542360004250539"
        },
        "id": "CURL-CVE-2026-82208-9a967e5c",
        "target": {
            "function": "Curl_wssl_setup_x509_store",
            "file": "lib/vtls/wolfssl.c"
        },
        "source": "https://github.com/curl/curl.git/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a",
        "signature_version": "v1"
    }
]
source 
"https://curl.se/docs/CURL-CVE-2026-82208.json"
vanir_signatures_modified 
"2026-09-03T02:01:57Z"