by Kastro
Paper/Archive/CVE-2026-11564

CVE-2026-11564

curl curl — Native CA trust persist

EPSS 0.6%public exploitCVSS 9.1
critical.is priorityof 100
47
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 49.2.492 × 209.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Affected

ProductAffectedFixed inSource
curl8.17.0 – < 8.20.18.20.1CNA
curleefd03c572996e5de4dec4fe295ad6f103e0eefc – < d69bfad3fa3daf5e72331f6870667607828d5891d69bfad3fa3daf5e72331f6870667607828d5891CNA
curl8.20.0–CNA
curl8.19.0–CNA
curl8.18.0–CNA
curl8.17.0–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refcurl.se/docs/CVE-2026-11564.jsonrefcurl.se/docs/CVE-2026-11564.htmlexploithackerone.com/reports/3788984