Low
exposing HTTP/3 early data
Type: advisorySources: OSV
In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-9545
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:36 UTC · Revision 1
Source evidence
In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.
osv:CURL-CVE-2026-9545
Complete source record
{
"id": "4e445a45c65a8da973f18dce56335d386c4a6c2ea9feb523d44f9df90788099a",
"url": "https://osv.dev/vulnerability/CURL-CVE-2026-9545",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "exposing HTTP/3 early data",
"summary": "In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.",
"evidence": "osv:CURL-CVE-2026-9545",
"products": [],
"severity": "low",
"structured": {
"id": "CURL-CVE-2026-9545",
"aliases": [
"CURL-CVE-2026-9545",
"CVE-2026-9545"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "8.11.0"
},
{
"fixed": "8.14.2"
},
{
"introduced": "8.15.0"
},
{
"fixed": "8.16.1"
},
{
"introduced": "8.17.0"
},
{
"fixed": "8.20.1"
},
{
"introduced": "8.21.0"
},
{
"fixed": "8.21.0"
}
]
},
{
"repo": "https://github.com/curl/curl.git",
"type": "GIT",
"events": [
{
"introduced": "962097b8dd44ed5b9e7984bc1cdffdbdd566857f"
},
{
"fixed": "7b9613fa9b1a5e04301a3920eef58e8138dad05e"
}
]
}
],
"versions": [
"8.20.0",
"8.19.0",
"8.18.0",
"8.17.0",
"8.16.0",
"8.15.0",
"8.14.1",
"8.14.0",
"8.13.0",
"8.12.1",
"8.12.0",
"8.11.1",
"8.11.0",
"curl-8_20_0",
"rc-8_20_0-3",
"rc-8_20_0-2",
"rc-8_20_0-1",
"curl-8_19_0",
"rc-8_19_0-3",
"rc-8_19_0-2",
"rc-8_19_0-1",
"curl-8_18_0",
"rc-8_18_0-3",
"rc-8_18_0-2",
"rc-8_18_0-1",
"curl-8_17_0",
"curl-8_16_0",
"curl-8_15_0",
"curl-8_14_1",
"curl-8_14_0",
"curl-8_13_0",
"curl-8_12_1",
"curl-8_12_0",
"curl-8_11_1",
"curl-8_11_0"
],
"database_specific": {
"source": "https://curl.se/docs/CURL-CVE-2026-9545.json",
"vanir_signatures": [
{
"id": "CURL-CVE-2026-9545-0d23da02",
"digest": {
"length": 1860,
"function_hash": "153317582380559109273442960860016262309"
},
"source": "https://github.com/curl/curl.git/commit/7b9613fa9b1a5e04301a3920eef58e8138dad05e",
"target": {
"file": "lib/vquic/curl_ngtcp2.c",
"function": "cf_ngtcp2_handshake_completed"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-9545-54b362b4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57837649208692003109394932325481589562",
"148897155669795626335640653234286619658",
"9221967505252324245084890594736647812",
"229339314465024621466349949698476012120",
"316992347216962730835430776133092520281",
"138701791296620101350765089525540312140",
"296327085920196481168568880711169351555",
"5354081226792327714123399886029077496",
"60630981963415792295832576530337112547",
"123864576250417216190818910419145918435",
"142835053885326796857721237189839522787",
"192948789493812143984840421097894964353",
"280733359488708788015184071526492175907",
"111945068324397344898130947918406342943",
"315163984305334991863463999532320024294",
"61010276926023090237519678734162290207",
"49355929218012117922133473512437199901",
"7905145105583230885624546070173304809",
"57003410938242733606680334162856661189",
"299257298584114877497706458750155152547"
]
},
"source": "https://github.com/curl/curl.git/commit/7b9613fa9b1a5e04301a3920eef58e8138dad05e",
"target": {
"file": "lib/vquic/curl_ngtcp2.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-9545-837feabc",
"digest": {
"length": 1412,
"function_hash": "225529865282307993815272211670638534898"
},
"source": "https://github.com/curl/curl.git/commit/7b9613fa9b1a5e04301a3920eef58e8138dad05e",
"target": {
"file": "lib/vquic/curl_ngtcp2.c",
"function": "cf_ngtcp2_recv"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-9545-8e6fa72c",
"digest": {
"length": 2382,
"function_hash": "126594513254768600204067746099346311735"
},
"source": "https://github.com/curl/curl.git/commit/7b9613fa9b1a5e04301a3920eef58e8138dad05e",
"target": {
"file": "lib/vquic/curl_ngtcp2.c",
"function": "cf_ngtcp2_send"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-9545-d0afa7aa",
"digest": {
"length": 2392,
"function_hash": "116844867287374578722968671244621372900"
},
"source": "https://github.com/curl/curl.git/commit/7b9613fa9b1a5e04301a3920eef58e8138dad05e",
"target": {
"file": "lib/vquic/curl_ngtcp2.c",
"function": "cf_ngtcp2_connect"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-25T01:04:34Z"
}
}
],
"modified": "2026-10-25T01:04:34.878194086Z",
"provider": "osv",
"references": [],
"provider_metadata": {
"CWE": {
"id": "CWE-200",
"desc": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"URL": "https://curl.se/docs/CVE-2026-9545.json",
"www": "https://curl.se/docs/CVE-2026-9545.html",
"issue": "https://hackerone.com/reports/3752888",
"affects": "both",
"package": "curl",
"severity": "Low",
"last_affected": "8.20.0"
}
},
"related_cves": [
{
"value": "CVE-2026-9545",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 444262,
"published_at": "2026-06-24T08:00:00+00:00"
}