CVE-2026-11564

critical · 9.1

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

9.1

CVSS

0.4%

EPSS (exploit prob.)

30th

EPSS percentile

2026-07-03

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-295

Affected products

Vendor	Product	Affected versions
haxx	curl	>= 8.17.0, < 8.21.0

Check a specific version with /api/v1/cve/match.

References

https://curl.se/docs/CVE-2026-11564.html
https://curl.se/docs/CVE-2026-11564.json
https://hackerone.com/reports/3788984
https://hackerone.com/reports/3788984

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-11564