CURL-CVE-2026-86415

See a problem?
Please try reporting it to the source first.
Source
https://curl.se/docs/CVE-2026-86415.html
Import Source
https://curl.se/docs/CURL-CVE-2026-86415.json
JSON Data
https://api.osv.dev/v1/vulns/CURL-CVE-2026-86415
Aliases
  • CVE-2026-86415
Published
2026-10-14T08:00:00Z
Modified
2026-10-14T07:07:43Z
Summary
auto client cert connection reuse mixup
Details

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.

Database specific 
{
    "CWE":  {
        "desc":  "Information Exposure Through Sent Data",
        "id":  "CWE-201"
    },
    "URL":  "https://curl.se/docs/CVE-2026-86415.json",
    "affects":  "both",
    "issue":  "https://hackerone.com/reports/3993870",
    "last_affected":  "8.22.0",
    "package":  "curl",
    "severity":  "Low",
    "www":  "https://curl.se/docs/CVE-2026-86415.html"
}
Credits
    • Stanislav Fort (Aisle Research) - FINDER
    • Stefan Eissing - REMEDIATION_DEVELOPER

Affected packages

Git / github.com/curl/curl.git

Affected ranges

Type
SEMVER
Events
Introduced
8.21.0
Fixed
8.23.0
Type
GIT
Repo
https://github.com/curl/curl.git
Events
Introduced
d69bfad3fa3daf5e72331f6870667607828d5891
Fixed
00271cfcb95b6481a1f91ce0a0dad5d64d2e89a9

Affected versions

8.*
8.21.0
8.22.0
Other
curl-8_21_0
curl-8_22_0
rc-8_21_0-2
rc-8_21_0-3
rc-8_22_0-1
rc-8_22_0-2
rc-8_22_0-3

Database specific

source 
"https://curl.se/docs/CURL-CVE-2026-86415.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "221156101499443906608227260510325783105",
                "236691930074514372172761985994549579562",
                "87552873736059427188659769012857249727",
                "2261316115968731167141485057459097947",
                "338997327704633442819362607869172330354",
                "90039016081043598297828963801306256614",
                "51204049838112377104434492560153628367",
                "99819243514244420436403008162133190844",
                "24638029331818786378675239181278887715",
                "116521474940328590756130683143025153758",
                "327008790706839130301354670512994575899",
                "124753113553593727664035004296454842520",
                "200144269697746153511320834882294770192",
                "317959944928504910667636854627796215540",
                "23112629028412196279081243066756547191",
                "304612604881570849770971313483982912866",
                "69732763951213074295358469988151746485",
                "194993656677815340743236399621065423236",
                "151086296801830577371714648126189069961"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-86415-188f5a30",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/00271cfcb95b6481a1f91ce0a0dad5d64d2e89a9",
        "target":  {
            "file":  "lib/vtls/vtls_config.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "237885006630744435525618707020037635339",
            "length":  621
        },
        "id":  "CURL-CVE-2026-86415-4352acbe",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/00271cfcb95b6481a1f91ce0a0dad5d64d2e89a9",
        "target":  {
            "file":  "lib/vtls/vtls_config.c",
            "function":  "ssl_easy_config_compl_options"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "161925260050497920993787877895168199972",
                "80113313513845360472012468395619317470",
                "246359440047644319765996939271974750943",
                "185874962925935284863620127320177699749",
                "132500656675738456646157615444162895272",
                "151141941519564467978126044219783188437",
                "209262484507173274922289399931551518992",
                "236894706061429383667683035156404062273",
                "225315542748781978591800458679726256343",
                "302599197581018947803256341372958773321",
                "60777811430929976493552024461203812148",
                "8583093735728894315382881520874825589"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-86415-66446c38",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/00271cfcb95b6481a1f91ce0a0dad5d64d2e89a9",
        "target":  {
            "file":  "lib/vtls/schannel.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "121375521470112711296954851834031347241",
                "165492355112910155157487711711919343967",
                "256461739043981636400963883016764450294",
                "309560068936994400469567756260494135809",
                "9394911737996564919463994555767540821",
                "90246634023373284408540935961026264119",
                "259687968195641741410814273368718075693",
                "88016737665023821855031894967731555810"
            ],
            "threshold":  0.9
        },
        "id":  "CURL-CVE-2026-86415-769803b5",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/00271cfcb95b6481a1f91ce0a0dad5d64d2e89a9",
        "target":  {
            "file":  "lib/vtls/vtls_config.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "76472231560661524317557181403402245070",
            "length":  968
        },
        "id":  "CURL-CVE-2026-86415-8810a560",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/00271cfcb95b6481a1f91ce0a0dad5d64d2e89a9",
        "target":  {
            "file":  "lib/vtls/vtls_config.c",
            "function":  "clone_ssl_primary_config"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "164142790038746544066286670265552099273",
            "length":  5554
        },
        "id":  "CURL-CVE-2026-86415-9078f340",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/00271cfcb95b6481a1f91ce0a0dad5d64d2e89a9",
        "target":  {
            "file":  "lib/vtls/schannel.c",
            "function":  "schannel_connect_step1"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "206706383335988581649664336520746820127",
            "length":  1520
        },
        "id":  "CURL-CVE-2026-86415-9d2bef35",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/curl/curl.git/commit/00271cfcb95b6481a1f91ce0a0dad5d64d2e89a9",
        "target":  {
            "file":  "lib/vtls/vtls_config.c",
            "function":  "match_ssl_primary_config"
        }
    }
]
vanir_signatures_modified 
"2026-10-14T07:07:43Z"