CVE-2026-80231
Fixed in a distro release EPSS <1%CVSS 7.5
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.
Products: curl
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.23 | curl | 8.22.0-r0 |
| Alpine 3.24 | curl | 8.22.0-r0 |
| Chainguard | curl | 8.22.0-r0 |
| Chainguard | libcurl4 | no fix |
| Red Hat hummingbird 1 | curl | 0:8.22.0-0.1.hum1 |
| Red Hat hummingbird 1 | libcurl | 0:8.22.0-0.1.hum1 |
| Red Hat hummingbird 1 | libcurl-devel | 0:8.22.0-0.1.hum1 |
| Red Hat hummingbird 1 | libcurl-minimal | 0:8.22.0-0.1.hum1 |
| Ubuntu 22.04 LTS | curl | no fix |
| Ubuntu 24.04 LTS | curl | no fix |
| Ubuntu 26.04 LTS | curl | no fix |
| Ubuntu Pro 14.04 LTS | curl | no fix |
| Ubuntu Pro 16.04 LTS | curl | no fix |
| Ubuntu Pro 18.04 LTS | curl | no fix |
| Ubuntu Pro 20.04 LTS | curl | no fix |
| Wolfi | curl | 8.22.0-r0 |
| Wolfi | libcurl4 | no fix |