Low
incomplete mTLS config matching in conn reuse
Type: advisorySources: OSV
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-8932
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:39 UTC · Revision 1
Source evidence
incomplete mTLS config matching in conn reuse
core-osv · Original sourcePublished 24 Jun 2026, 08:00 UTC
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.
osv:CURL-CVE-2026-8932
Complete source record
{
"id": "0cd9bd31a54715c1b6dee884937cd24ab935ff93e173c21d150a7ea3b4a66f58",
"url": "https://osv.dev/vulnerability/CURL-CVE-2026-8932",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "incomplete mTLS config matching in conn reuse",
"summary": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.",
"evidence": "osv:CURL-CVE-2026-8932",
"products": [],
"severity": "low",
"structured": {
"id": "CURL-CVE-2026-8932",
"aliases": [
"CURL-CVE-2026-8932",
"CVE-2026-8932"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "7.7"
},
{
"fixed": "8.14.2"
},
{
"introduced": "8.15.0"
},
{
"fixed": "8.16.1"
},
{
"introduced": "8.17.0"
},
{
"fixed": "8.20.1"
},
{
"introduced": "8.21.0"
},
{
"fixed": "8.21.0"
}
]
},
{
"repo": "https://github.com/curl/curl.git",
"type": "GIT",
"events": [
{
"introduced": "a1d6ad26100bc493c7b04f1301b1634b7f5aa8b4"
},
{
"fixed": "7541ae569d82fb308a5e2d94916027da4fa3ba3e"
}
]
}
],
"versions": [
"8.20.0",
"8.19.0",
"8.18.0",
"8.17.0",
"8.16.0",
"8.15.0",
"8.14.1",
"8.14.0",
"8.13.0",
"8.12.1",
"8.12.0",
"8.11.1",
"8.11.0",
"8.10.1",
"8.10.0",
"8.9.1",
"8.9.0",
"8.8.0",
"8.7.1",
"8.7.0",
"8.6.0",
"8.5.0",
"8.4.0",
"8.3.0",
"8.2.1",
"8.2.0",
"8.1.2",
"8.1.1",
"8.1.0",
"8.0.1",
"8.0.0",
"7.88.1",
"7.88.0",
"7.87.0",
"7.86.0",
"7.85.0",
"7.84.0",
"7.83.1",
"7.83.0",
"7.82.0",
"7.81.0",
"7.80.0",
"7.79.1",
"7.79.0",
"7.78.0",
"7.77.0",
"7.76.1",
"7.76.0",
"7.75.0",
"7.74.0",
"7.73.0",
"7.72.0",
"7.71.1",
"7.71.0",
"7.70.0",
"7.69.1",
"7.69.0",
"7.68.0",
"7.67.0",
"7.66.0",
"7.65.3",
"7.65.2",
"7.65.1",
"7.65.0",
"7.64.1",
"7.64.0",
"7.63.0",
"7.62.0",
"7.61.1",
"7.61.0",
"7.60.0",
"7.59.0",
"7.58.0",
"7.57.0",
"7.56.1",
"7.56.0",
"7.55.1",
"7.55.0",
"7.54.1",
"7.54.0",
"7.53.1",
"7.53.0",
"7.52.1",
"7.52.0",
"7.51.0",
"7.50.3",
"7.50.2",
"7.50.1",
"7.50.0",
"7.49.1",
"7.49.0",
"7.48.0",
"7.47.1",
"7.47.0",
"7.46.0",
"7.45.0",
"7.44.0",
"7.43.0",
"7.42.1",
"7.42.0",
"7.41.0",
"7.40.0",
"7.39.0",
"7.38.0",
"7.37.1",
"7.37.0",
"7.36.0",
"7.35.0",
"7.34.0",
"7.33.0",
"7.32.0",
"7.31.0",
"7.30.0",
"7.29.0",
"7.28.1",
"7.28.0",
"7.27.0",
"7.26.0",
"7.25.0",
"7.24.0",
"7.23.1",
"7.23.0",
"7.22.0",
"7.21.7",
"7.21.6",
"7.21.5",
"7.21.4",
"7.21.3",
"7.21.2",
"7.21.1",
"7.21.0",
"7.20.1",
"7.20.0",
"7.19.7",
"7.19.6",
"7.19.5",
"7.19.4",
"7.19.3",
"7.19.2",
"7.19.1",
"7.19.0",
"7.18.2",
"7.18.1",
"7.18.0",
"7.17.1",
"7.17.0",
"7.16.4",
"7.16.3",
"7.16.2",
"7.16.1",
"7.16.0",
"7.15.5",
"7.15.4",
"7.15.3",
"7.15.2",
"7.15.1",
"7.15.0",
"7.14.1",
"7.14.0",
"7.13.2",
"7.13.1",
"7.13.0",
"7.12.3",
"7.12.2",
"7.12.1",
"7.12.0",
"7.11.2",
"7.11.1",
"7.11.0",
"7.10.8",
"7.10.7",
"7.10.6",
"7.10.5",
"7.10.4",
"7.10.3",
"7.10.2",
"7.10.1",
"7.10",
"7.9.8",
"7.9.7",
"7.9.6",
"7.9.5",
"7.9.4",
"7.9.3",
"7.9.2",
"7.9.1",
"7.9",
"7.8.1",
"7.8",
"7.7.3",
"7.7.2",
"7.7.1",
"7.7",
"curl-8_20_0",
"rc-8_20_0-3",
"rc-8_20_0-2",
"rc-8_20_0-1",
"curl-8_19_0",
"rc-8_19_0-3",
"rc-8_19_0-2",
"rc-8_19_0-1",
"curl-8_18_0",
"rc-8_18_0-3",
"rc-8_18_0-2",
"rc-8_18_0-1",
"curl-8_17_0",
"curl-8_16_0",
"curl-8_15_0",
"curl-8_14_1",
"curl-8_14_0",
"curl-8_13_0",
"curl-8_12_1",
"curl-8_12_0",
"curl-8_11_1",
"curl-8_11_0",
"curl-8_10_1",
"curl-8_10_0",
"curl-8_9_1",
"curl-8_9_0",
"curl-8_8_0",
"curl-8_7_1",
"curl-8_7_0",
"curl-8_6_0",
"curl-8_5_0",
"tiny-curl-8_4_0",
"curl-8_4_0",
"curl-8_3_0",
"curl-8_2_1",
"curl-8_2_0",
"curl-8_1_2",
"curl-8_1_1",
"curl-8_1_0",
"curl-8_0_1",
"curl-8_0_0",
"curl-7_88_1",
"curl-7_88_0",
"curl-7_87_0",
"curl-7_86_0",
"curl-7_85_0",
"curl-7_84_0",
"curl-7_83_1",
"curl-7_83_0",
"curl-7_82_0",
"curl-7_81_0",
"curl-7_80_0",
"curl-7_79_1",
"curl-7_79_0",
"curl-7_78_0",
"curl-7_77_0",
"curl-7_76_1",
"curl-7_76_0",
"curl-7_75_0",
"curl-7_74_0",
"curl-7_73_0",
"tiny-curl-7_72_0",
"curl-7_72_0",
"curl-7_71_1",
"curl-7_71_0",
"curl-7_70_0",
"curl-7_69_1",
"curl-7_69_0",
"curl-7_68_0",
"curl-7_67_0",
"curl-7_66_0",
"curl-7_65_3",
"curl-7_65_2",
"curl-7_65_1",
"curl-7_65_0",
"curl-7_64_1",
"curl-7_64_0",
"curl-7_63_0",
"curl-7_62_0",
"curl-7_61_1",
"curl-7_61_0",
"curl-7_60_0",
"curl-7_59_0",
"curl-7_58_0",
"curl-7_57_0",
"curl-7_56_1",
"curl-7_56_0",
"curl-7_55_1",
"curl-7_55_0",
"curl-7_54_1",
"curl-7_54_0",
"curl-7_53_1",
"curl-7_53_0",
"curl-7_52_1",
"curl-7_52_0",
"curl-7_51_0",
"curl-7_50_3",
"curl-7_50_2",
"curl-7_50_1",
"curl-7_50_0",
"curl-7_49_1",
"curl-7_49_0",
"curl-7_48_0",
"curl-7_47_1",
"curl-7_47_0",
"curl-7_46_0",
"curl-7_45_0",
"curl-7_44_0",
"curl-7_43_0",
"curl-7_42_1",
"curl-7_42_0",
"curl-7_41_0",
"curl-7_40_0",
"curl-7_39_0",
"curl-7_38_0",
"curl-7_37_1",
"curl-7_37_0",
"curl-7_36_0",
"curl-7_35_0",
"curl-7_34_0",
"curl-7_33_0",
"curl-7_32_0",
"curl-7_31_0",
"curl-7_30_0",
"curl-7_29_0",
"curl-7_28_1",
"curl-7_28_0",
"curl-7_27_0",
"curl-7_26_0",
"curl-7_25_0",
"curl-7_24_0",
"curl-7_23_1",
"curl-7_23_0",
"curl-7_22_0",
"curl-7_21_7",
"curl-7_21_6",
"curl-7_21_5",
"curl-7_21_4",
"curl-7_21_3",
"curl-7_21_2",
"curl-7_21_1",
"curl-7_21_0",
"curl-7_20_1",
"curl-7_20_0",
"curl-7_19_7",
"curl-7_19_6",
"curl-7_19_5",
"curl-7_19_4",
"curl-7_19_3",
"curl-7_19_2",
"curl-7_19_1",
"curl-7_19_0",
"curl-7_18_2",
"curl-7_18_1",
"curl-7_18_0",
"curl-7_17_1",
"curl-7_17_0",
"curl-7_17_0-preldapfix",
"curl-7_16_4",
"curl-7_16_3",
"curl-7_16_2",
"curl-7_16_1",
"curl-7_16_0",
"curl-7_15_6-prepipeline",
"curl-7_15_5",
"curl-7_15_4",
"curl-7_15_3",
"curl-7_15_2",
"curl-7_15_1",
"curl-7_15_0",
"curl-7_14_1",
"curl-7_14_0",
"curl-7_13_2",
"curl-7_13_1",
"before_ftp_statemachine",
"curl-7_13_0",
"curl-7_12_3",
"curl-7_12_2",
"curl-7_12_1",
"curl-7_12_0",
"curl-7_11_2",
"curl-7_11_1",
"curl-7_11_0",
"curl-7_10_8",
"curl-7_10_7",
"curl-7_10_6",
"curl-7_10_5",
"curl-7_10_4",
"curl-7_10_3",
"curl-7_10_2",
"curl-7_10_1",
"curl-7_10",
"curl-7_9_8",
"curl-7_9_7",
"curl-7_9_7-pre2",
"curl-7_9_6",
"curl-7_9_5",
"curl-7_9_5-pre4",
"curl-7_9_5-pre2",
"curl-7_9_4",
"curl-7_9_3",
"curl-7_9_3-pre3",
"curl-7_9_3-pre2",
"curl-7_9_3-pre1",
"curl-7_9_2",
"curl-7_9_1",
"curl-7_9",
"before_urldata_rename",
"curl-7_8_1",
"curl-7_8_1-pre3",
"curl-7_8",
"curl-7_8-pre2",
"curl-7_7_3",
"curl-7_7_2",
"curl-7_7_1",
"curl-7_7",
"curl-7_7-beta5",
"curl-7_7-beta3",
"curl-7_7-beta2",
"curl-7_7-beta1",
"curl-7_7_alpha2"
],
"database_specific": {
"source": "https://curl.se/docs/CURL-CVE-2026-8932.json",
"vanir_signatures": [
{
"id": "CURL-CVE-2026-8932-13336cd9",
"digest": {
"length": 1578,
"function_hash": "175746625479112360998346037539057505994"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/mbedtls.c",
"function": "mbed_load_clicert"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-1397cbfd",
"digest": {
"length": 2205,
"function_hash": "870898239028971554604187732680575702"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/wolfssl.c",
"function": "wssl_client_cert"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-13c14dcc",
"digest": {
"length": 1380,
"function_hash": "46935999968874299865607613603611375"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/vtls_scache.c",
"function": "Curl_ssl_session_import"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-146e616e",
"digest": {
"length": 597,
"function_hash": "86313123241729106249093641429244788734"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/vtls.c",
"function": "free_primary_ssl_config"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-1a507f57",
"digest": {
"length": 2003,
"function_hash": "124190285171390662456597991080704449090"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vssh/libssh2.c",
"function": "ssh_state_pkey_init"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-36e95ee4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"80862229856524033104917171627597968877",
"247803201788547966307761812574525605207",
"122757360052964465495476721782896604656",
"35415285788153893279389431298997719802"
]
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vssh/libssh2.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-3abb67ef",
"digest": {
"length": 2399,
"function_hash": "168811840740689393095263357389858540467"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/mbedtls.c",
"function": "mbed_load_privkey"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-4051d61c",
"digest": {
"length": 3426,
"function_hash": "322156640790580503829526878036975820535"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/vtls_scache.c",
"function": "Curl_ssl_peer_key_make"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-513cba53",
"digest": {
"threshold": 0.9,
"line_hashes": [
"113039407112265038998765654552035572691",
"242913420036182063367940383239573004573",
"278973572554032248502284298391275979387",
"129941200059681863141753492878173145999",
"318577976057063368306539421088734378626"
]
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/ldap.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-625a39c5",
"digest": {
"length": 492,
"function_hash": "212697413827725388948767402678721080004"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/vtls_scache.c",
"function": "cf_ssl_scache_match_auth"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-680c786d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"80643577687604573429066753305061575978",
"194369058902949167218445409618414450795",
"301112568050706856132355632702528549347",
"104582360384520121153519823531766573930",
"256957385524087093005222928509745467212",
"260721047795024333920667785542625643544",
"310429472742867529852281268127234444004",
"140664390600350717219692565688579595799",
"96869374771762832369135955175068182552",
"87837397241283765394864353011207740617",
"303829844048966820270729648503870850712",
"122213521494725642778505319231400029364"
]
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vssh/libssh.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-70d46bfd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"181270230242809567009756638043169742680",
"209980567116188135588487189384331583976",
"273885960487946908476744038556708984114",
"49248109589978742382106569467149898057",
"322861117402775893138560920982070061331",
"144028553147728781970072522020302591125",
"276527356416977608547474121837581328378",
"163673092817957291096879750955809593326",
"48439208393128808325797198222909443716",
"5292753335004315430930261188396215662",
"282513269628630348948766750727767585337",
"233107998742682198289534274329256639866",
"262919725880543708549586890898945249959",
"218876329222855989524175466772121581834",
"291069068860828651872100873136875147862"
]
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/urldata.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-7178fe2e",
"digest": {
"length": 808,
"function_hash": "124928086820281458324555561551868897579"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/vtls.c",
"function": "clone_ssl_primary_config"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-7410371e",
"digest": {
"length": 4419,
"function_hash": "264762701548966124989245699776694146046"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/vtls.c",
"function": "Curl_ssl_easy_config_complete"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-781a7dd2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"285865301448214901310043594818430009632",
"165017503388311822225368428963913131770",
"267076527656394390294488471714595188934",
"282895032685452778006797402316107330322",
"249672976881610510634107706169444990039",
"200479800068661522824637859624262138472",
"224477797927916845915021491884166806318",
"186735110968762527841013595567660748527",
"57981454056056313700286654092089256360",
"211566082279552544697784672934183852376",
"103711081373832036330033479743869539650",
"212168345440071108384720742483623748219",
"112341885940199143489869728841362371091",
"295679265441311819115222381403704684681",
"335666360367316234952871958379593667310",
"36186238934166933404895133084644810095",
"110556592254068947424986880540766661861"
]
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/schannel.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-814b6a19",
"digest": {
"threshold": 0.9,
"line_hashes": [
"27869016268787505007846972844295097259",
"106171828960945990530346176224937589938",
"161483349965163629933900714134892156054"
]
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/vtls_scache.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-86a606c4",
"digest": {
"length": 4093,
"function_hash": "191138660969734471579867520232719245537"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/mbedtls.c",
"function": "mbed_configure_ssl"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-8a28d818",
"digest": {
"length": 921,
"function_hash": "70952655031714318064397442826955046006"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/vtls_scache.c",
"function": "cf_ssl_add_peer"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-8ac7bfd7",
"digest": {
"length": 1387,
"function_hash": "194704066241744887052641733493717648803"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/vtls.c",
"function": "match_ssl_primary_config"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-8e306693",
"digest": {
"length": 481,
"function_hash": "112823091842400050074364866963206113549"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/vtls_scache.c",
"function": "cf_ssl_scache_clear_peer"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-8f462353",
"digest": {
"length": 1725,
"function_hash": "145801252058214405522042574575711834750"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/rustls.c",
"function": "init_config_builder_client_auth"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-943d0cba",
"digest": {
"threshold": 0.9,
"line_hashes": [
"139648805926239617519520232016833905817",
"183087726575497529273522795599540234149",
"88968464741428171571011357521289361947",
"272085787993596240103680845316053623293",
"198519629873628633394593794367278149121",
"279729464748783768388820679987726945443",
"266997753011297918992926778843761028901",
"235686775519643758529900985996019014936",
"289687720382082660623221690738425605140"
]
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/openssl.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-9795d2da",
"digest": {
"length": 4771,
"function_hash": "242802535356130838472072196227723136027"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/schannel.c",
"function": "get_client_cert"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-99c463ce",
"digest": {
"length": 7978,
"function_hash": "251726362032484936482476442955864224943"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/ldap.c",
"function": "ldap_do"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-9f5d86f0",
"digest": {
"length": 994,
"function_hash": "330132591205480897785374893163179130889"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/vtls_scache.c",
"function": "cf_ssl_scache_peer_init"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-a082fda9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"154028160645161306397776077923944794185",
"18822645313244226685295829346371255498",
"78371869204415636379715462914201771407",
"292899094926693804470083212892598447305",
"37659464735867337397241630700091825029",
"78559668193299868787330466383925872217",
"292346628075780853257762169651225809329",
"214000049100177761095203184667254182550",
"72221857498647661427756611000501922198",
"330939179641932111387428720422913292032",
"19042094289856033907102581860191366582",
"167876518684862366303934690856050394278",
"172705776036660961747981663640221841330",
"37659464735867337397241630700091825029",
"78559668193299868787330466383925872217",
"292346628075780853257762169651225809329",
"66554236948298936899726181451739218487",
"233427640935161181638390846899336624015",
"41738628622922494183493200140710486877",
"240723747878628896108150362059180136008"
]
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/wolfssl.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-bb011a3a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"21054647346384507892377623276020207956",
"255910819670120783385942806897650096362",
"15366925316261397217665336601751086359",
"176683949854557374164448495691502459788",
"45856990936582592720266902655643586958",
"113697784067858342069163874609347826484",
"93154871523718644199597127652770500270",
"280419077562609709259192306507522416292",
"52350101854180122938805362184651210365",
"9541861292011165980929513415706443694",
"181817044049698512091194699196323587686",
"326253106649779620760738428379100698152",
"239538362015617212866040732376864876308",
"19709675791145061559552496515675325184",
"159861103761800367034238290387748342021",
"103322999423095643466746538828605765796",
"13871233677174778956872254022712952342",
"200856859909085823976314829987647596198",
"158771579791679356574819319522755212842",
"101659210156436432947192642802281556863",
"139796361019768663339785504369259129277",
"295852362464225999141415198868068172380",
"175136205520922214954540717833272974561",
"240664442693156574290504096370444504193",
"174857213537792833158487526425264700379",
"183598008667046493141472097406459304153",
"53914854208304873979999960213836321330",
"4255112098031992478384804301337912386",
"211665031083587815903293227304656042431",
"278565130928762661344774194783179457808",
"280104416443090646614552393129189562320",
"202997142927621897517150811846807046695",
"175493048878056956552460324771893529885",
"144200512770454831412693971858363593361",
"255981172535163111454953462203322955956",
"68673281123511664433594718330838155339",
"264118582412589283960144720259057956584",
"163673791374620508843853131362680627629",
"158917866426044087441306935432175584024",
"113676063115754733892749203492267332763",
"198387256845075082393832253128451761696",
"37775737192923604234246588028581754172",
"148478314128555119715402296034441916089",
"289329447750920844263814446500727935735",
"166952640004655960612590703135675861184",
"270801133952586562389396574409419334902",
"100449166070024259145202243296021887670",
"3242636560839085572975530534624370903",
"21772754240803315653731399190964490989",
"57530952263566672770531421906500153815",
"31000275868366443018167458630300347418",
"104715317092347931206995816575215698785",
"334348344549747414427622816746152380082",
"155722594885463432352519287066685212549",
"286379277411887647479587259079968795466",
"3810397465318789924314242359634088952",
"59365913025733355572351338874817458139",
"86704689066105110295852096331839149499",
"334324944157751583636166628613417109632",
"56670654710260483921678743745233117605",
"272660415929746926575761080098193394914",
"294337654312068964470060064316290835153",
"63193725064819557838236445744977415703",
"339356179856099750763692455608481355306",
"223084217724351567859103186403477121641",
"9836864318692369435648615885441489690",
"218615140515642595067246855655293799376",
"22812652136396227402600390323624879216",
"319166438570279931786266450233883617797",
"117585823972304928818363397364762972185",
"218536147264057066697910974192034635078"
]
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/vtls_scache.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-bd3dba0c",
"digest": {
"length": 216,
"function_hash": "103758809396553412944798457145103091866"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/vtls_scache.c",
"function": "cf_ssl_cache_peer_update"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-bd60fa6d",
"digest": {
"length": 2138,
"function_hash": "335750361397585050297239622418199114772"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/mbedtls.c",
"function": "mbed_load_cacert"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-be23c6d1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"63680271443118673340583303490677929635",
"25295578148269534496580282015256981257",
"251092589214536742569420088984708587526",
"303808097776044867491743115608901547226",
"138955379641196594386745978759081954107",
"316389251878985802159757931036509446071",
"223739395497036001591599360350990630520",
"303808097776044867491743115608901547226",
"1230011239008799301840488261754969914",
"184730254983917058343117271025887920663",
"74200977057609015810382050026223128257",
"283793968014865859603003752917524798052",
"337103460827073719055490329146091344700",
"259195190016384486716253875608797683741",
"170745052831324478055002393706357424865",
"295005068393002039710580010749440044378",
"278612883063918501976469184737216346764",
"152957887352325284518375119083252843197",
"165856999169062377074975292724686519137",
"41186269563069795523514592120770911458",
"205431018594345812687545218773951653148",
"276957636365209855843174966112576873429",
"24645885585976864069921312390194498221",
"283061227063551218008949292773699620870",
"238776002098889617921438550601367107329",
"186470420435547661159181517884717565052",
"94810953025715922310043587765812959002",
"10557209189641732960650248791964452403",
"96679677980377208520345062011335551410",
"5968622470152600891849480267823972216",
"31620918909212069346468137967768764383",
"259698913544789531263810761276259622199",
"230825315940662229481172796568073033326",
"45076675055265452634561024700564074467",
"266157986080888917763527653374601383743"
]
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/mbedtls.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-c20c5737",
"digest": {
"length": 5683,
"function_hash": "333896482370869401103594449766808456513"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/openssl.c",
"function": "Curl_ossl_ctx_init"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-d89ee88a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"2261316115968731167141485057459097947",
"218878064510094976839685685929466139563",
"129829612938398134073878903037467304112",
"302132349135155618468065530855674297989",
"325577645294600483704470611178050682928",
"218991936396188190751905558592166829380",
"285339658377942651109491721442483931835",
"262517950022613391291206703347677899337",
"99819243514244420436403008162133190844",
"278871627037554761294389438901669302199",
"10993914417656733560465763125234241573",
"258949413042078010646459209107476204983",
"211541907055670776715099572796923414053",
"192624272634694294458278594268065661742",
"5031075333697200889232422638667999537",
"111972068776020624040371682382725970727",
"180394632541853818516320263654631294473",
"112005113970071353567841224869211003613",
"100400864007877490508532885062748928276",
"54014629393632681267665329924174881938",
"112130096817272108921960945484631495392",
"326200095940088667947736971244162919158",
"211411195444718537885485402633711728560",
"197324248070166864587695624965990875450",
"15710514720387014553823428718851442468",
"7291275804895508235001766069930383818",
"337365318880941366839846000436764138172",
"137792359810422534611099734708980321153",
"283287686554360635043747036991481087067",
"333331296270853535582406311229558896171",
"41763277086006908062174009309533909857",
"115479653389130960422950848720213019390",
"89819942541541302729401439880082940809",
"287640939555238703607375020973819468953",
"136076646510923854311575367082848995687",
"90920917114946486082381111878524474910",
"52100338320107355546220399827765220926",
"266294334014596911934934594764893286081",
"184750210343204476998666398997031398581",
"297973853986999387601382898827722338280",
"262553743821213397431764916372803774436"
]
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/vtls.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-dc194fa8",
"digest": {
"length": 1265,
"function_hash": "254830399638493341772478312232231081780"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vssh/libssh.c",
"function": "myssh_in_AUTH_PKEY_INIT"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-dd4707aa",
"digest": {
"threshold": 0.9,
"line_hashes": [
"253856078298901279057669843917062199929",
"236648852106103825288428753310632603742",
"177239864025320514292778847116960173142",
"143750692224238965150587436843843453690",
"295094449840606997923801648016771094805",
"198068271115141439495464930277778487530",
"103970211698719919195007149548081945565",
"69635759116343817539151071819465321518",
"13469813334155406633463258912669837754",
"56038087730974851422214845987123568647",
"69948790958557668635129468877188497010",
"141173061205098551480311316399171743270",
"218091733005037266769441199866070989932",
"106891314413225368786825526267629632733",
"143895874252771187470230480495735122382",
"98809179647346624056168574853445980721",
"274140847310540377498512173205911024365",
"240023440402456849685681442384189145541",
"191405985725576352640977973536260875981",
"276916955575962265964214300728473740551"
]
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/rustls.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-f3d8de0f",
"digest": {
"length": 4735,
"function_hash": "31985418175801213350060953684438402315"
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/gtls.c",
"function": "gtls_client_init"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-8932-f453da64",
"digest": {
"threshold": 0.9,
"line_hashes": [
"137004000350921581260165019766976272853",
"82230745369626625305696777816335373765",
"49604686216848521773931526581166017388",
"150198710160133243483536877660906993772",
"40713591620386689999929207011890309076",
"141335316865783088365390499161374166458",
"82563274532544210319609388695638201860",
"237616988876434478510812939028774640157",
"148641259302187665041055655553345715798",
"167280313770269775364220907328110012274",
"143877982550457113453028881635496011857",
"278607998740817607505219246497826895345",
"9756480148519625769379465689261118437",
"39116614586147455429555301909084209751",
"141541489072858482290726418002127610953",
"729922929140134971032400646926344189",
"185375298389212791383533616316421877568",
"270372699550450823029193386814194464164"
]
},
"source": "https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e",
"target": {
"file": "lib/vtls/gtls.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-25T01:05:48Z"
}
}
],
"modified": "2026-10-25T01:05:48.560960589Z",
"provider": "osv",
"references": [],
"provider_metadata": {
"CWE": {
"id": "CWE-305",
"desc": "Authentication Bypass by Primary Weakness"
},
"URL": "https://curl.se/docs/CVE-2026-8932.json",
"www": "https://curl.se/docs/CVE-2026-8932.html",
"issue": "https://hackerone.com/reports/3733910",
"affects": "lib",
"package": "curl",
"severity": "Low",
"last_affected": "8.20.0"
}
},
"related_cves": [
{
"value": "CVE-2026-8932",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 444431,
"published_at": "2026-06-24T08:00:00+00:00"
}