VDB
JLSEC-2026-391
JLSEC-2026-391
PUBLISHED
CVSS 8.699999809265137 HIGH
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.
Risk Scores
CVSS 4.0
8.699999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Julia | CURL_jll | 0 |
| Julia | LibCURL_jll | 0 |
Timeline
- May 4, 2026 CVE Published
- May 4, 2026 CVE Updated
- May 18, 2026 Distribution Patch
References
- http://www.openwall.com/lists/oss-security/2023/03/20/6 url
- https://hackerone.com/reports/1555796 url
- https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html url
- https://security.gentoo.org/glsa/202212-01 url
- https://security.netapp.com/advisory/ntap-20220609-0009/ url
- https://www.debian.org/security/2022/dsa-5197 url