CVE-2026-80231: libcurl HTTPS Connection Reuse Vulnerability

CVE-2026-80231 Overview

A flaw in libcurl causes it to incorrectly reuse an existing HTTPS connection for a given hostname even when the application specifies a different Native CA Store setting (CURLSSLOPT_NATIVE_CA) than the one used when the original connection was created. The result is that a request intended to be validated against a different certificate authority store may instead be sent over a connection established under mismatched trust settings. This connection reuse logic error weakens the security guarantees callers expect when toggling the native CA store option between transfers.

Critical Impact
Applications relying on CURLSSLOPT_NATIVE_CA for per-request trust decisions may transmit requests over connections established under unintended CA validation settings, undermining TLS trust assumptions.

Affected Products

libcurl (versions supporting CURLSSLOPT_NATIVE_CA)
Applications and services that link against affected libcurl builds
Refer to the cURL CVE-2026-80231 Documentation for the exact affected version range

Discovery Timeline

2026-09-06 - CVE-2026-80231 published to the National Vulnerability Database
2026-09-08 - Last updated in the NVD database

Technical Details for CVE-2026-80231

Vulnerability Analysis

libcurl maintains a connection cache to reuse existing TCP and TLS sessions across multiple transfers to the same origin. Connection reuse is gated by a set of matching criteria that must include every TLS option capable of changing trust or verification behavior.

The defect is that libcurl does not treat the CURLSSLOPT_NATIVE_CA bit as a discriminator when evaluating cache hits. A caller that first performs a request without the native CA store, then issues a second request to the same hostname with CURLSSLOPT_NATIVE_CA enabled (or vice versa), can receive the previously established connection. The second request therefore runs over a session whose certificate validation used a CA source the caller did not intend.

This behavior is categorized under [CWE-488] (Exposure of Data Element to Wrong Session) because trust state established for one logical session leaks into another. See the HackerOne Report #3969368 for reporter details.

Root Cause

The connection matching logic in libcurl omits the CURLSSLOPT_NATIVE_CA flag from the fields compared when selecting a reusable connection from the pool. Two transfers that differ only in this option are treated as equivalent for reuse purposes.

Attack Vector

Exploitation requires an application that toggles CURLSSLOPT_NATIVE_CA between requests to the same host. A network-positioned attacker who can influence which CA store validates a given transfer may be able to keep a request bound to a connection validated against a broader or narrower trust set than intended. Depending on the caller's threat model, this can lead to denial of the intended trust boundary or acceptance of a certificate chain that the caller expected to reject.

No verified public exploit code is available. Refer to the cURL CVE-2026-80231 Documentation for the vendor's technical write-up.

Detection Methods for CVE-2026-80231

Indicators of Compromise

No specific host-based or network indicators are published for this issue; detection is primarily version-based.
Unexpected TLS validation outcomes for hosts contacted by applications that switch CURLSSLOPT_NATIVE_CA between transfers.

Detection Strategies

Inventory all binaries and containers that statically or dynamically link libcurl and compare versions against the fixed release noted in the vendor advisory.
Review application source code for calls to curl_easy_setopt with CURLOPT_SSL_OPTIONS toggling CURLSSLOPT_NATIVE_CA across handles that share a CURLM or connection cache.
Audit software bills of materials (SBOMs) for transitive libcurl dependencies in third-party components.

Monitoring Recommendations

Monitor outbound TLS sessions from applications known to use libcurl for certificate chains that fail post-hoc validation against the intended CA source.
Track libcurl version rollout across the fleet after patching to confirm remediation coverage.
Log and alert on TLS errors surfaced by applications after upgrading, as fixed builds will begin refusing to reuse mismatched connections.

How to Mitigate CVE-2026-80231

Immediate Actions Required

Identify every application and container image that ships libcurl and enumerate affected versions.
Upgrade libcurl to the fixed release listed in the cURL CVE-2026-80231 Documentation.
Rebuild and redeploy statically linked applications that embed libcurl.
Restart long-running services after the upgrade so cached connections established under the flawed logic are discarded.

Patch Information

The curl project has published fix details and the affected version range in the cURL CVE-2026-80231 JSON Details. Apply the vendor-provided patch or upgrade to a release that includes CURLSSLOPT_NATIVE_CA in the connection reuse comparison.

Workarounds

Avoid mixing transfers with and without CURLSSLOPT_NATIVE_CA on the same CURL or CURLM handle pool.
Force a fresh connection for transfers that require a specific CA source by setting CURLOPT_FRESH_CONNECT to 1 and CURLOPT_FORBID_REUSE to 1.
Segregate workloads by using distinct multi handles for each trust configuration to prevent cache overlap.

bash

# Configuration example: force a fresh TLS connection when the caller
# needs a specific CA source, as a workaround until libcurl is patched.
curl --ssl-no-revoke \
     --cacert /etc/ssl/certs/custom-ca.pem \
     -o /dev/null \
     https://example.com/

# In application code (C):
# curl_easy_setopt(curl, CURLOPT_FRESH_CONNECT, 1L);
# curl_easy_setopt(curl, CURLOPT_FORBID_REUSE, 1L);
# curl_easy_setopt(curl, CURLOPT_SSL_OPTIONS, CURLSSLOPT_NATIVE_CA);