{"id":"CURL-CVE-2026-107929","summary":"local interface connection reuse mixup","details":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address","aliases":["CVE-2026-107929"],"modified":"2026-10-14T19:02:57.260138646Z","published":"2026-10-14T08:00:00Z","database_specific":{"URL":"https://curl.se/docs/CVE-2026-107929.json","www":"https://curl.se/docs/CVE-2026-107929.html","issue":"https://hackerone.com/reports/4099618","CWE":{"id":"CWE-488","desc":"Exposure of Data Element to Wrong Session"},"last_affected":"8.22.0","severity":"Low","package":"curl","affects":"both"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"8.9.0"},{"fixed":"8.14.3"},{"introduced":"8.15.0"},{"fixed":"8.16.2"},{"introduced":"8.17.0"},{"fixed":"8.20.2"},{"introduced":"8.21.0"},{"fixed":"8.23.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"3060557af702dd59155ea703a0790455c2f49a59"},{"fixed":"d37d79df1e01066417aff0a9e6bc675edad3edba"}]}],"versions":["8.22.0","8.21.0","8.20.0","8.19.0","8.18.0","8.17.0","8.16.0","8.15.0","8.14.1","8.14.0","8.13.0","8.12.1","8.12.0","8.11.1","8.11.0","8.10.1","8.10.0","8.9.1","8.9.0","rc-8_23_0-3","rc-8_23_0-2","rc-8_23_0-1","curl-8_22_0","rc-8_22_0-3","rc-8_22_0-2","rc-8_22_0-1","curl-8_21_0","rc-8_21_0-3","rc-8_21_0-2","rc-8_21_0-1","curl-8_20_0","rc-8_20_0-3","rc-8_20_0-2","rc-8_20_0-1","curl-8_19_0","rc-8_19_0-3","rc-8_19_0-2","rc-8_19_0-1","curl-8_18_0","rc-8_18_0-3","rc-8_18_0-2","rc-8_18_0-1","curl-8_17_0","curl-8_16_0","curl-8_15_0","curl-8_14_1","curl-8_14_0","curl-8_13_0","curl-8_12_1","curl-8_12_0","curl-8_11_1","curl-8_11_0","curl-8_10_1","curl-8_10_0","curl-8_9_1","curl-8_9_0"],"database_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["33020138232155442830075670003334574911","284496318731629087141625997780098648157","303810388758707012354860312689069220902","297991860763815203074504086583422266007","320738731781992127111231261139417733998","183355512448777274762417343089455919698","327037773882404803493005135630719992721","336816732232193545647996595725117146784","333922100016805542905735223533904565279","302161740985268037992741830546816892734","152565993869504700647831362893325960965","236785012361113850722983374919551400303","250990469105218562137812073281062396809","265055169885016502813618027537581269531","335093259878661112883911847880410867294","270151552962586029188134749841005948407","319365032065212819612558915299481130884","245225474651377462538439534491557631839","13766214190832539937349899346812664422","139910345167148674428191338879273283076","27105961946935237132347203899648593673","160143544109260659576718363567253889129","155942508610337650375829391273276518620","54014406768191730793879183146276455395","7579389191057427449223444008431806377","268998884163826117524530243890700983193"],"threshold":0.9},"id":"CURL-CVE-2026-107929-06a47425","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba","target":{"file":"lib/setopt.c"}},{"signature_version":"v1","source":"https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba","target":{"file":"lib/cf-socket.c","function":"bindlocal"},"deprecated":false,"digest":{"length":4615,"function_hash":"154092934692214753891100031030585287566"},"id":"CURL-CVE-2026-107929-11f7cbe3","signature_type":"Function"},{"source":"https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba","target":{"file":"lib/url.c","function":"url_match_connect_config"},"deprecated":false,"digest":{"length":727,"function_hash":"216311387717917335966008888650279651201"},"id":"CURL-CVE-2026-107929-57281d70","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba","target":{"file":"lib/urldata.h"},"deprecated":false,"digest":{"line_hashes":["241761572520213555815986056258028473518","163601861664714743800796619752796183035","301086512416807435301410295087456542065","201061082653926972482711153051397625531","155772763066964582268942135830122181461","236760497796532790112481304454223766281","78229127818962189212955549976780213979","319225037750470863747197998147443682305","237424357299181299228072909154614780340","138705466990541979074338740716845372091"],"threshold":0.9},"id":"CURL-CVE-2026-107929-6c03fe0e","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"292477562089670203546715531281855032631","length":966},"id":"CURL-CVE-2026-107929-764f72b0","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba","target":{"file":"lib/url.c","function":"Curl_conn_free"}},{"digest":{"line_hashes":["295471359500447413983506171453182920072","102537179141412352703412724965194714124","253065603714626584192827515944205048613","53086521482358518454694277165161113997","278883379426524064491317862448381897927","78574684170504972670587354460513098254","31943940246699968108493056152378679547","5083707108630385855929631925951027747","46059668823259700362759565207716767937","178394624426392169185063832772425982707","247502614701560520177589191552868473704","279118966899911942467357341576905317302","195846308979971471901981500488563296077","18855817798437235251451650598114305082","105864727788617692189089432493518387072","31703315142492533254074442015070059561","152202466067929385653533129649295176440","182980106233807485102192909226238534403","157135655820733821835811366814926919691","94809630114563572021978955989229958217","134293798001907610396521083790962910417","222282469926179157414751087589579001064"],"threshold":0.9},"id":"CURL-CVE-2026-107929-88e71522","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba","target":{"file":"lib/url.c"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba","target":{"file":"lib/cf-socket.c","function":"Curl_parse_interface"},"deprecated":false,"digest":{"function_hash":"259011240289427334554940194434727253752","length":1493},"id":"CURL-CVE-2026-107929-8af31516"},{"signature_version":"v1","source":"https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba","target":{"function":"setstropt_interface","file":"lib/setopt.c"},"deprecated":false,"digest":{"length":521,"function_hash":"165700183563521820635241199037808038496"},"id":"CURL-CVE-2026-107929-9d3b2b76","signature_type":"Function"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["240965199293963040657462781825043274306","325946073268998296221267341170805573275","161640061417606002698681785146929937703","302839495064354881349821188927915667033","133954066936573215356027271573791408778","247165320603286810793565282486563192110","193256390999540614316227033904785474945","221532175889607628411783885514768542636","305499140329563737444338400601966151175","68398906592569300523369606696890784028","323911849138958289925609114626597167039","282380787767237373395857515020191908688","297359965580113738310417812189274657403","93092124178344738472206795528813125936","267904494059351927795816571766463726891","139633433816409880911503739064410014726","297669038191481671044558879282196738757","243464594113434836304316827964548995145","60782010540698563080804620860495232373","73485865333706556177611286645421320657","181675481760836591809191026820394747412","4379488974094506383523559080089570242","164445395282578676102034586715499167552","296799701481345743179792304784711596759","328866562827620159195538597322521034853","251348661015263466825783410069892031209","225958704073314054748635651367767469767","87424921850342866959386140772178402666","328378543984623678754276527871924028783","108392085691230563096297613224863266416","260484233268280570360266982796410344517","81144316950926554740167604411882240748","216534967855080800143571935888272382802","131479412399064995761000322462446049332","205155597383629923149822363046429740394","226908033118161122998475485214091309012","329585480246353887087574658262478055667","86287363936475492143279473303486072945","77530511929617101001688490542174612989","130344516320563162856213914607584114373","123871891556393757966698575664914084200","175200032352015712574574421417429878058","88094472011592327144519716919150536954","173827880235007152714631447574692914419","227436730230839496667790906781429370129","108006597334242478313557223431739697659","61980273567006545651731772684002951391","13240688382365622586288418068378469987","316506885062440248980792724615890302520","230734042705755621630983839206833912944","257990234214385080086986174134158743012","13841977920785428109069930956932320339","13126770451193411558462605900882930669","61404804460176638403567844897469869080","204477106088722445423057627436981623600","224458961571057888218669460028722634234","66884575245799898823099320101937911553","18676836453661791843188957757166144922","90603538492438094044997283166823009211","230363972447557415589848012455996039702","218705691217539404203348162030099689111","242110244547041355669995072849744603713","183242829559431050036314163991987214339","213366377822931337695804678205370584301","233102408512923946390527938234531064215","282254455405980793091468143226823127362","292219757685419083600378378185994508696","115080839958162681641791987847338172872","271657245486746252440671206474324619777","12961135213277731284337566419443870927","313541043695844769309535327302849569637","254851863711351280563415993925122047197","294641844104989860485448518050397627832","276484725839215918772713873147010969712","130008688414223729511610950920983849316","28706223577252231616883296606693092602","214424515885556204186388673530628488015","309770038588769846483834314765726733591","284874780514674249735921665945783324967","315673732513036155195697754996243388216","78189467574956907167535925279231244801","258776238864208222802197637724472373701","20149792378438124116137036878508576402","150914943872853674225484912607704914456","4648763021237051344160136121637827990","153302099546013622130040335922316018833","268847273557575212523935400498590267978","255425651120485246257885565001746249887","291160749033063950786255850808463788473","209319521664839668822041326635017859859","117262052801663669835939155996964377440","15772031990569790513939502773343419517","215296571844817188613113380136167484607","325650273960132007881864488802978436441","326998349713637031499113786754324545391","24142217891431779001139407516608752817","197071279266064039427863835565027900782","125526119893853453765621831925435275622","306322138103110709169461979850860440589","224811516342675137510813567804098665487","271819307446197735239396915170518896475","135627799642184460457027255500473805720","332754287052043346141988755639860121150","199888541337461908393945277351767808659","300912636596397938197826700491996001564","252855987410619850217753075063122157977","289991005256100515723801876537193353444","310406779611750798457867550648759612662","28215562786753059694742451789353523209","85763879348970170860407938759684388517","247895283437076443659319112739469569610","188563272038283577540947493690691292708"]},"id":"CURL-CVE-2026-107929-d04bac37","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba","target":{"file":"lib/cf-socket.c"}},{"id":"CURL-CVE-2026-107929-ef5644c6","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/d37d79df1e01066417aff0a9e6bc675edad3edba","target":{"function":"allocate_conn","file":"lib/url.c"},"deprecated":false,"digest":{"function_hash":"195391317365540274191655587606053165838","length":1374}}],"vanir_signatures_modified":"2026-10-14T19:02:57Z","source":"https://curl.se/docs/CURL-CVE-2026-107929.json"}}],"schema_version":"1.9.0","credits":[{"name":"Maksim Hayder","type":"FINDER"},{"name":"Stefan Eissing","type":"REMEDIATION_DEVELOPER"}]}