{"id":"CURL-CVE-2026-86415","summary":"auto client cert connection reuse mixup","details":"libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this.","aliases":["CVE-2026-86415"],"modified":"2026-10-14T07:07:43.866136242Z","published":"2026-10-14T08:00:00Z","database_specific":{"severity":"Low","package":"curl","affects":"both","URL":"https://curl.se/docs/CVE-2026-86415.json","www":"https://curl.se/docs/CVE-2026-86415.html","issue":"https://hackerone.com/reports/3993870","CWE":{"id":"CWE-201","desc":"Information Exposure Through Sent Data"},"last_affected":"8.22.0"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"8.21.0"},{"fixed":"8.23.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"d69bfad3fa3daf5e72331f6870667607828d5891"},{"fixed":"00271cfcb95b6481a1f91ce0a0dad5d64d2e89a9"}]}],"versions":["8.22.0","8.21.0","curl-8_22_0","rc-8_22_0-3","rc-8_22_0-2","rc-8_22_0-1","curl-8_21_0","rc-8_21_0-3","rc-8_21_0-2"],"database_specific":{"vanir_signatures_modified":"2026-10-14T07:07:43Z","source":"https://curl.se/docs/CURL-CVE-2026-86415.json","vanir_signatures":[{"digest":{"line_hashes":["221156101499443906608227260510325783105","236691930074514372172761985994549579562","87552873736059427188659769012857249727","2261316115968731167141485057459097947","338997327704633442819362607869172330354","90039016081043598297828963801306256614","51204049838112377104434492560153628367","99819243514244420436403008162133190844","24638029331818786378675239181278887715","116521474940328590756130683143025153758","327008790706839130301354670512994575899","124753113553593727664035004296454842520","200144269697746153511320834882294770192","317959944928504910667636854627796215540","23112629028412196279081243066756547191","304612604881570849770971313483982912866","69732763951213074295358469988151746485","194993656677815340743236399621065423236","151086296801830577371714648126189069961"],"threshold":0.9},"id":"CURL-CVE-2026-86415-188f5a30","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/00271cfcb95b6481a1f91ce0a0dad5d64d2e89a9","target":{"file":"lib/vtls/vtls_config.c"},"deprecated":false},{"target":{"file":"lib/vtls/vtls_config.c","function":"ssl_easy_config_compl_options"},"deprecated":false,"digest":{"function_hash":"237885006630744435525618707020037635339","length":621},"id":"CURL-CVE-2026-86415-4352acbe","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/00271cfcb95b6481a1f91ce0a0dad5d64d2e89a9"},{"source":"https://github.com/curl/curl.git/commit/00271cfcb95b6481a1f91ce0a0dad5d64d2e89a9","target":{"file":"lib/vtls/schannel.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["161925260050497920993787877895168199972","80113313513845360472012468395619317470","246359440047644319765996939271974750943","185874962925935284863620127320177699749","132500656675738456646157615444162895272","151141941519564467978126044219783188437","209262484507173274922289399931551518992","236894706061429383667683035156404062273","225315542748781978591800458679726256343","302599197581018947803256341372958773321","60777811430929976493552024461203812148","8583093735728894315382881520874825589"]},"id":"CURL-CVE-2026-86415-66446c38","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/00271cfcb95b6481a1f91ce0a0dad5d64d2e89a9","target":{"file":"lib/vtls/vtls_config.h"},"deprecated":false,"digest":{"line_hashes":["121375521470112711296954851834031347241","165492355112910155157487711711919343967","256461739043981636400963883016764450294","309560068936994400469567756260494135809","9394911737996564919463994555767540821","90246634023373284408540935961026264119","259687968195641741410814273368718075693","88016737665023821855031894967731555810"],"threshold":0.9},"id":"CURL-CVE-2026-86415-769803b5"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/00271cfcb95b6481a1f91ce0a0dad5d64d2e89a9","target":{"function":"clone_ssl_primary_config","file":"lib/vtls/vtls_config.c"},"deprecated":false,"digest":{"function_hash":"76472231560661524317557181403402245070","length":968},"id":"CURL-CVE-2026-86415-8810a560"},{"deprecated":false,"digest":{"length":5554,"function_hash":"164142790038746544066286670265552099273"},"id":"CURL-CVE-2026-86415-9078f340","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/00271cfcb95b6481a1f91ce0a0dad5d64d2e89a9","target":{"function":"schannel_connect_step1","file":"lib/vtls/schannel.c"}},{"deprecated":false,"digest":{"function_hash":"206706383335988581649664336520746820127","length":1520},"id":"CURL-CVE-2026-86415-9d2bef35","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/00271cfcb95b6481a1f91ce0a0dad5d64d2e89a9","target":{"function":"match_ssl_primary_config","file":"lib/vtls/vtls_config.c"}}]}}],"schema_version":"1.9.0","credits":[{"name":"Stanislav Fort (Aisle Research)","type":"FINDER"},{"name":"Stefan Eissing","type":"REMEDIATION_DEVELOPER"}]}