Exposure of Data Element to Wrong Session in cURL - CVE-2026-80231

Vulnerability identifier: #VU146680

CSH Severity: Low

CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-80231

CWE-ID: CWE-488

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to bypass intended certificate validation settings.

The vulnerability exists due to exposure of data element to wrong session in HTTPS connection reuse logic when reusing an existing connection for the same hostname with a different native CA store setting. A remote user can cause a transfer to use a previously established HTTPS connection to bypass intended certificate validation settings.

This issue affects Windows and macOS and also impacts the curl command line tool.

cURL
openEuler
Anolis OS
curl-help
libcurl-devel
libcurl
curl-debugsource
curl-debuginfo
curl
curl-minimal
libcurl-minimal
curl-doc

Install security update from vendor's website.

cURL - update to 8.22.0
curl-help - addressed in versions 7.71.1-54, 7.79.1-56, 8.4.0-37
libcurl-devel - addressed in versions 7.71.1-54, 7.79.1-56, 8.4.0-37
libcurl - addressed in versions 7.71.1-54, 7.79.1-56, 8.4.0-37
curl-debugsource - addressed in versions 7.71.1-54, 7.79.1-56, 8.4.0-37
curl-debuginfo - addressed in versions 7.71.1-54, 7.79.1-56, 8.4.0-37
curl - addressed in versions 7.71.1-54, 7.79.1-56, 8.4.0-37
curl - update to 8.4.0-30
curl-minimal - update to 8.4.0-30
libcurl - update to 8.4.0-30
libcurl-devel - update to 8.4.0-30
libcurl-minimal - update to 8.4.0-30
curl-doc - update to 8.4.0-30

• https://curl.se/docs/CVE-2026-80231.html
• https://github.com/curl/curl/commit/7be1e70cb6bcd83e130ecf

• Multiple vulnerabilities in cURL
• openEuler 24.03 LTS SP4 update for curl
• openEuler 24.03 LTS SP3 update for curl
• openEuler 24.03 LTS SP1 update for curl
• openEuler 22.03 LTS SP4 update for curl
• openEuler 20.03 LTS SP4 update for curl
• Anolis OS update for curl