CVE-2026-11564

Description

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Traduire en français

Produits concernés

• curl
• Haxx curl

Scores CVSS

Faiblesses (CWE)

• CWE-295

Références

• https://curl.se/docs/CVE-2026-11564.html PatchVendor Advisory
• https://curl.se/docs/CVE-2026-11564.json Vendor Advisory
• https://hackerone.com/reports/3788984 ExploitIssue TrackingThird Party Advisory
• https://hackerone.com/reports/3788984 ExploitIssue TrackingThird Party Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories