Exposure of Data Element to Wrong Session in cURL - CVE-2026-107929
Published: October 14, 2026
Vulnerability identifier: #VU155693
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-107929
CWE-ID: CWE-488
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause transfers to use an unintended source address.
The vulnerability exists due to omission of source bindings from the connection reuse key in curl's connection reuse logic when processing transfers configured through CURLOPT_INTERFACE or --interface with the if!, host!, or ifhost! prefixes. A local user can initiate a later transfer requesting a different source that silently reuses an existing connection to cause transfers to use an unintended source address.
Affected software
cURL
How to mitigate CVE-2026-107929
Install security update from vendor's website.
cURL - update to 8.23.0