Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
curl may let another connection reuse your credentials
published 2 months ago
Summary
The curl command‑line tool and its libraries on CentOS can mistakenly share a client certificate, private key, or password between separate connections. This could allow an unauthorized party to access services that require mutual TLS authentication. Update curl to the latest version or apply the provided patch to stop the credential sharing.
What to do
- Update centos curl to version 7.61.1-22.el8.tuxcare.els22.
- Update centos curl-minimal to version 7.61.1-22.el8.tuxcare.els22.
- Update centos libcurl to version 7.61.1-22.el8.tuxcare.els22.
- Update centos libcurl-devel to version 7.61.1-22.el8.tuxcare.els22.
- Update centos libcurl-minimal to version 7.61.1-22.el8.tuxcare.els22.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:8.5 | centos | curl |
< 7.61.1-22.el8.tuxcare.els22 Fix: upgrade to 7.61.1-22.el8.tuxcare.els22
|
| TuxCare:CentOS:8.5 | centos | curl-minimal |
< 7.61.1-22.el8.tuxcare.els22 Fix: upgrade to 7.61.1-22.el8.tuxcare.els22
|
| TuxCare:CentOS:8.5 | centos | libcurl |
< 7.61.1-22.el8.tuxcare.els22 Fix: upgrade to 7.61.1-22.el8.tuxcare.els22
|
| TuxCare:CentOS:8.5 | centos | libcurl-devel |
< 7.61.1-22.el8.tuxcare.els22 Fix: upgrade to 7.61.1-22.el8.tuxcare.els22
|
| TuxCare:CentOS:8.5 | centos | libcurl-minimal |
< 7.61.1-22.el8.tuxcare.els22 Fix: upgrade to 7.61.1-22.el8.tuxcare.els22
|
Original advisory text
curl: Fix of CVE-2026-8932
- CVE-2026-8932: authentication bypass through connection reuse, where the
client certificate type, private key, key type and key password were not
part of the SSL configuration compared by Curl_ssl_config_matches(), so an
easy handle could inherit another handle's authenticated mTLS connection
client certificate type, private key, key type and key password were not
part of the SSL configuration compared by Curl_ssl_config_matches(), so an
easy handle could inherit another handle's authenticated mTLS connection
References
- https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1786092535.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-8932 Vendor Advisory
Timeline
Published7 Aug 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1786092535 · OSV
Track software like this
Free during beta