Improper Certificate Validation in cURL - CVE-2026-11564
Published: June 24, 2026
Vulnerability identifier: #VU135073
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-11564
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass certificate trust restrictions.
The vulnerability exists due to improper certificate validation in libcurl connection reuse logic when reusing an easy handle after switching from native CA trust to custom CA material. A remote attacker can present a TLS certificate trusted by the native platform store to bypass certificate trust restrictions.
This issue applies to builds that use Native CA by default on Apple operating systems or Windows, and affects the OpenSSL, GnuTLS, Schannel, and Rustls TLS backends.
Affected software
cURL
LANTIME Operating System Firmware (LTOS)
Ubuntu
curl (Ubuntu package)
LANTIME Operating System Firmware (LTOS)
Ubuntu
curl (Ubuntu package)
How to mitigate CVE-2026-11564
Install security update from vendor's website.
cURL - update to 8.21.0
LANTIME Operating System Firmware (LTOS) - update to 7.10.013
curl (Ubuntu package) - addressed in versions 7.35.0-1ubuntu2.20+esm21, 7.47.0-1ubuntu2.19+esm17, 7.58.0-2ubuntu3.24+esm10, 7.68.0-1ubuntu2.25+esm5, 8.5.0-2ubuntu10.11, 8.14.1-2ubuntu1.5, 8.18.0-1ubuntu2.3
LANTIME Operating System Firmware (LTOS) - update to 7.10.013
curl (Ubuntu package) - addressed in versions 7.35.0-1ubuntu2.20+esm21, 7.47.0-1ubuntu2.19+esm17, 7.58.0-2ubuntu3.24+esm10, 7.68.0-1ubuntu2.25+esm5, 8.5.0-2ubuntu10.11, 8.14.1-2ubuntu1.5, 8.18.0-1ubuntu2.3