Intelligence online17 sources monitored15 actively exploited 7d40 published 24hChecked recently
Vulnerability record

CVE-2026-8932

HighNo known exploitation

Patch status

Official fix available since

Apply the vendor's update to every affected system. Check the fixed-in versions below where known.

Basis: NVD patch reference

Description

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Intelligence timeline

Developments from the last 30 days, newest first.

  1. CVSS scoredUpdate

    CVE-2026-8932 scored CVSS 7.5

    Basis: NIST National Vulnerability Database

  2. Patch releasedUpdate

    Patch released for CVE-2026-8932

    An official fix is now available.

    Basis: NVD patch reference

Coverage

References