USN-8670-1: curl vulnerability

unknownpublic exploitCVE-2026-8932

Joshua Rogers discovered that curl incorrectly handled reusing connections when client certificate settings changed. This could result in the wrong client certificates being used, contrary to expectations.

CSIRTS triage

vendor: curl product: curl Authentication bypass

What: curl incorrectly reuses connections when client certificate settings change, resulting in wrong client certificates being used.
Who is affected: Applications and users relying on curl's client certificate authentication, particularly those with dynamic certificate configurations.
Urgency: Moderate — authentication bypass in certificate handling; no active exploitation reported but affects confidentiality of authenticated connections.
Action: Update curl to a version fixing CVE-2026-8932.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch curl

Get an email when a new curl advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-08-24
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8670-1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-89320.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-8932	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownUSN-8670-2: curl vulnerabilityubuntu
medium[UPDATE] [medium] cURL: Multiple vulnerabilitiescert-bund
unknownMultiple vulnerabilities in Microsoft Azure Linux (July 15, 2026)cert-fr-avis
highCVE-2026-8932: incomplete mTLS config matching in conn reusemsrc
highCVE-2026-8932: libcurl would reuse a previously created connection even when some mTLS config related option h…nvd
unknownMultiple vulnerabilities in cURL and libcurl (June 24, 2026)cert-fr-avis