CVE-2026-9545: Haxx Curl Information Disclosure Flaw

CVE-2026-9545 Overview

CVE-2026-9545 is a certificate validation vulnerability in libcurl affecting HTTP/3 connections that use TLS session resumption combined with early data (0-RTT). When CURLOPT_SSL_SESSIONID_CACHE is enabled and the CURLSSLOPT_EARLYDATA bit is set in CURLOPT_SSL_OPTIONS, libcurl can transmit request bytes on a resumed connection before enforcing certificate verification. An attacker impersonating a previously visited HTTP/3 server can receive sensitive request data even without presenting a valid certificate.

Critical Impact
Sensitive request data, including credentials and cookies, may leak to an attacker-controlled impostor server before libcurl aborts the connection on certificate verification failure.

Affected Products

Haxx curl (libcurl HTTP/3 builds)
Applications linking libcurl with early data enabled
Deployments using CURLSSLOPT_EARLYDATA with cached SSL sessions

Discovery Timeline

2026-07-03 - CVE-2026-9545 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-9545

Vulnerability Analysis

The flaw exists in libcurl's HTTP/3 transfer path when TLS 1.3 session resumption is combined with 0-RTT early data. On the first transfer, libcurl establishes a valid HTTP/3 session with the intended server and caches the SSL session ticket. On a subsequent transfer to the same hostname, libcurl attempts a resumed handshake and sends application data as early data before completing certificate verification.

If an attacker has replaced the endpoint at that hostname, the impostor server receives the second request's bytes without needing to present a valid certificate. libcurl eventually detects the verification failure and aborts, but the sensitive payload has already been transmitted. The behavior violates the security expectation that a certificate verification failure prevents any request data from reaching an unverified peer.

Root Cause

The root cause is an ordering defect in libcurl's HTTP/3 handshake logic. Early data transmission is scheduled before the certificate verification result is enforced on the resumed session. The vulnerability is classified under [NVD-CWE-noinfo] and behaves as an improper certificate validation and information disclosure condition.

Attack Vector

Exploitation requires network-adjacent positioning that allows the attacker to take over the target hostname between transfers. This includes DNS hijacking, BGP redirection, or on-path interception. The attacker does not need any valid credentials or user interaction. The victim application must have CURLSSLOPT_EARLYDATA enabled and session ID caching active, which are non-default but supported configurations. The vulnerability details are described in the curl.se CVE-2026-9545 Advisory and the HackerOne Report #3752888.

Detection Methods for CVE-2026-9545

Indicators of Compromise

Unexpected TLS certificate verification failures logged immediately after HTTP/3 session resumption attempts
Repeated 0-RTT handshake attempts to the same hostname followed by connection aborts
DNS or routing anomalies redirecting known HTTP/3 destinations to unfamiliar IP addresses

Detection Strategies

Inventory applications that link libcurl and query build options for HTTP/3 and early data support
Audit source code and configuration for uses of CURLSSLOPT_EARLYDATA combined with an active CURLOPT_SSL_SESSIONID_CACHE
Compare deployed libcurl versions against the fixed release listed in the curl.se CVE-2026-9545 Advisory

Monitoring Recommendations

Log outbound HTTP/3 (QUIC) connections that terminate with TLS verification errors and alert on spikes
Monitor DNS resolution changes for hostnames repeatedly contacted by libcurl-based services
Correlate certificate verification failures with subsequent application errors that may indicate leaked request data

How to Mitigate CVE-2026-9545

Immediate Actions Required

Upgrade libcurl to the patched version identified in the curl.se CVE-2026-9545 Advisory
Disable CURLSSLOPT_EARLYDATA in application code until the upgrade is deployed
Optionally disable session ID caching with CURLOPT_SSL_SESSIONID_CACHE set to 0 to break the resumption path

Patch Information

The curl project has published a fix and detailed advisory. Review the curl.se CVE-2026-9545 Advisory and curl.se CVE-2026-9545 JSON Details for the affected version range and the specific commit that enforces certificate verification before early data transmission on resumed HTTP/3 connections.

Workarounds

Do not set the CURLSSLOPT_EARLYDATA bit in CURLOPT_SSL_OPTIONS for sensitive transfers
Set CURLOPT_SSL_SESSIONID_CACHE to 0 to force full handshakes and prevent 0-RTT usage
Restrict HTTP/3 usage to trusted network paths until the patched libcurl is rolled out

bash

# Configuration example: disable early data and session caching in libcurl callers
curl_easy_setopt(curl, CURLOPT_SSL_OPTIONS, 0L);       /* clear CURLSSLOPT_EARLYDATA */
curl_easy_setopt(curl, CURLOPT_SSL_SESSIONID_CACHE, 0L); /* disable session reuse */