{"id":"CURL-CVE-2026-8932","summary":"incomplete mTLS config matching in conn reuse","details":"libcurl would reuse a previously created connection even when some mTLS config\nrelated option had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, some TLS\nsettings related to client certificates were left out from the configuration\nmatch checks, making them match too easily. In particular options related to\nthe private key.","aliases":["CVE-2026-8932"],"modified":"2026-06-24T08:07:06.138726Z","published":"2026-06-24T08:00:00Z","database_specific":{"issue":"https://hackerone.com/reports/3733910","package":"curl","last_affected":"8.20.0","CWE":{"desc":"Authentication Bypass by Primary Weakness","id":"CWE-305"},"severity":"Low","URL":"https://curl.se/docs/CVE-2026-8932.json","affects":"lib","www":"https://curl.se/docs/CVE-2026-8932.html"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"7.7"},{"fixed":"8.21.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"a1d6ad26100bc493c7b04f1301b1634b7f5aa8b4"},{"fixed":"7541ae569d82fb308a5e2d94916027da4fa3ba3e"}]}],"versions":["8.20.0","8.19.0","8.18.0","8.17.0","8.16.0","8.15.0","8.14.1","8.14.0","8.13.0","8.12.1","8.12.0","8.11.1","8.11.0","8.10.1","8.10.0","8.9.1","8.9.0","8.8.0","8.7.1","8.7.0","8.6.0","8.5.0","8.4.0","8.3.0","8.2.1","8.2.0","8.1.2","8.1.1","8.1.0","8.0.1","8.0.0","7.88.1","7.88.0","7.87.0","7.86.0","7.85.0","7.84.0","7.83.1","7.83.0","7.82.0","7.81.0","7.80.0","7.79.1","7.79.0","7.78.0","7.77.0","7.76.1","7.76.0","7.75.0","7.74.0","7.73.0","7.72.0","7.71.1","7.71.0","7.70.0","7.69.1","7.69.0","7.68.0","7.67.0","7.66.0","7.65.3","7.65.2","7.65.1","7.65.0","7.64.1","7.64.0","7.63.0","7.62.0","7.61.1","7.61.0","7.60.0","7.59.0","7.58.0","7.57.0","7.56.1","7.56.0","7.55.1","7.55.0","7.54.1","7.54.0","7.53.1","7.53.0","7.52.1","7.52.0","7.51.0","7.50.3","7.50.2","7.50.1","7.50.0","7.49.1","7.49.0","7.48.0","7.47.1","7.47.0","7.46.0","7.45.0","7.44.0","7.43.0","7.42.1","7.42.0","7.41.0","7.40.0","7.39.0","7.38.0","7.37.1","7.37.0","7.36.0","7.35.0","7.34.0","7.33.0","7.32.0","7.31.0","7.30.0","7.29.0","7.28.1","7.28.0","7.27.0","7.26.0","7.25.0","7.24.0","7.23.1","7.23.0","7.22.0","7.21.7","7.21.6","7.21.5","7.21.4","7.21.3","7.21.2","7.21.1","7.21.0","7.20.1","7.20.0","7.19.7","7.19.6","7.19.5","7.19.4","7.19.3","7.19.2","7.19.1","7.19.0","7.18.2","7.18.1","7.18.0","7.17.1","7.17.0","7.16.4","7.16.3","7.16.2","7.16.1","7.16.0","7.15.5","7.15.4","7.15.3","7.15.2","7.15.1","7.15.0","7.14.1","7.14.0","7.13.2","7.13.1","7.13.0","7.12.3","7.12.2","7.12.1","7.12.0","7.11.2","7.11.1","7.11.0","7.10.8","7.10.7","7.10.6","7.10.5","7.10.4","7.10.3","7.10.2","7.10.1","7.10","7.9.8","7.9.7","7.9.6","7.9.5","7.9.4","7.9.3","7.9.2","7.9.1","7.9","7.8.1","7.8","7.7.3","7.7.2","7.7.1","7.7","curl-8_20_0","rc-8_20_0-3","rc-8_20_0-2","rc-8_20_0-1","curl-8_19_0","rc-8_19_0-3","rc-8_19_0-2","rc-8_19_0-1","curl-8_18_0","rc-8_18_0-3","rc-8_18_0-2","rc-8_18_0-1","curl-8_17_0","curl-8_16_0","curl-8_15_0","curl-8_14_1","curl-8_14_0","curl-8_13_0","curl-8_12_1","curl-8_12_0","curl-8_11_1","curl-8_11_0","curl-8_10_1","curl-8_10_0","curl-8_9_1","curl-8_9_0","curl-8_8_0","curl-8_7_1","curl-8_7_0","curl-8_6_0","curl-8_5_0","tiny-curl-8_4_0","curl-8_4_0","curl-8_3_0","curl-8_2_1","curl-8_2_0","curl-8_1_2","curl-8_1_1","curl-8_1_0","curl-8_0_1","curl-8_0_0","curl-7_88_1","curl-7_88_0","curl-7_87_0","curl-7_86_0","curl-7_85_0","curl-7_84_0","curl-7_83_1","curl-7_83_0","curl-7_82_0","curl-7_81_0","curl-7_80_0","curl-7_79_1","curl-7_79_0","curl-7_78_0","curl-7_77_0","curl-7_76_1","curl-7_76_0","curl-7_75_0","curl-7_74_0","curl-7_73_0","tiny-curl-7_72_0","curl-7_72_0","curl-7_71_1","curl-7_71_0","curl-7_70_0","curl-7_69_1","curl-7_69_0","curl-7_68_0","curl-7_67_0","curl-7_66_0","curl-7_65_3","curl-7_65_2","curl-7_65_1","curl-7_65_0","curl-7_64_1","curl-7_64_0","curl-7_63_0","curl-7_62_0","curl-7_61_1","curl-7_61_0","curl-7_60_0","curl-7_59_0","curl-7_58_0","curl-7_57_0","curl-7_56_1","curl-7_56_0","curl-7_55_1","curl-7_55_0","curl-7_54_1","curl-7_54_0","curl-7_53_1","curl-7_53_0","curl-7_52_1","curl-7_52_0","curl-7_51_0","curl-7_50_3","curl-7_50_2","curl-7_50_1","curl-7_50_0","curl-7_49_1","curl-7_49_0","curl-7_48_0","curl-7_47_1","curl-7_47_0","curl-7_46_0","curl-7_45_0","curl-7_44_0","curl-7_43_0","curl-7_42_1","curl-7_42_0","curl-7_41_0","curl-7_40_0","curl-7_39_0","curl-7_38_0","curl-7_37_1","curl-7_37_0","curl-7_36_0","curl-7_35_0","curl-7_34_0","curl-7_33_0","curl-7_32_0","curl-7_31_0","curl-7_30_0","curl-7_29_0","curl-7_28_1","curl-7_28_0","curl-7_27_0","curl-7_26_0","curl-7_25_0","curl-7_24_0","curl-7_23_1","curl-7_23_0","curl-7_22_0","curl-7_21_7","curl-7_21_6","curl-7_21_5","curl-7_21_4","curl-7_21_3","curl-7_21_2","curl-7_21_1","curl-7_21_0","curl-7_20_1","curl-7_20_0","curl-7_19_7","curl-7_19_6","curl-7_19_5","curl-7_19_4","curl-7_19_3","curl-7_19_2","curl-7_19_1","curl-7_19_0","curl-7_18_2","curl-7_18_1","curl-7_18_0","curl-7_17_1","curl-7_17_0","curl-7_17_0-preldapfix","curl-7_16_4","curl-7_16_3","curl-7_16_2","curl-7_16_1","curl-7_16_0","curl-7_15_6-prepipeline","curl-7_15_5","curl-7_15_4","curl-7_15_3","curl-7_15_2","curl-7_15_1","curl-7_15_0","curl-7_14_1","curl-7_14_0","curl-7_13_2","curl-7_13_1","before_ftp_statemachine","curl-7_13_0","curl-7_12_3","curl-7_12_2","curl-7_12_1","curl-7_12_0","curl-7_11_2","curl-7_11_1","curl-7_11_0","curl-7_10_8","curl-7_10_7","curl-7_10_6","curl-7_10_5","curl-7_10_4","curl-7_10_3","curl-7_10_2","curl-7_10_1","curl-7_10","curl-7_9_8","curl-7_9_7","curl-7_9_7-pre2","curl-7_9_6","curl-7_9_5","curl-7_9_5-pre4","curl-7_9_5-pre2","curl-7_9_4","curl-7_9_3","curl-7_9_3-pre3","curl-7_9_3-pre2","curl-7_9_3-pre1","curl-7_9_2","curl-7_9_1","curl-7_9","before_urldata_rename","curl-7_8_1","curl-7_8_1-pre3","curl-7_8","curl-7_8-pre2","curl-7_7_3","curl-7_7_2","curl-7_7_1","curl-7_7","curl-7_7-beta5","curl-7_7-beta3","curl-7_7-beta2","curl-7_7-beta1","curl-7_7_alpha2"],"database_specific":{"vanir_signatures":[{"signature_type":"Function","digest":{"length":1578,"function_hash":"175746625479112360998346037539057505994"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-13336cd9","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"mbed_load_clicert","file":"lib/vtls/mbedtls.c"}},{"signature_type":"Function","digest":{"length":2205,"function_hash":"870898239028971554604187732680575702"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-1397cbfd","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"wssl_client_cert","file":"lib/vtls/wolfssl.c"}},{"signature_type":"Function","digest":{"length":1380,"function_hash":"46935999968874299865607613603611375"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-13c14dcc","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"Curl_ssl_session_import","file":"lib/vtls/vtls_scache.c"}},{"signature_type":"Function","digest":{"length":597,"function_hash":"86313123241729106249093641429244788734"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-146e616e","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"free_primary_ssl_config","file":"lib/vtls/vtls.c"}},{"signature_type":"Function","digest":{"length":2003,"function_hash":"124190285171390662456597991080704449090"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-1a507f57","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"ssh_state_pkey_init","file":"lib/vssh/libssh2.c"}},{"signature_type":"Line","digest":{"line_hashes":["80862229856524033104917171627597968877","247803201788547966307761812574525605207","122757360052964465495476721782896604656","35415285788153893279389431298997719802"],"threshold":0.9},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-36e95ee4","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"file":"lib/vssh/libssh2.c"}},{"signature_type":"Function","digest":{"length":2399,"function_hash":"168811840740689393095263357389858540467"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-3abb67ef","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"mbed_load_privkey","file":"lib/vtls/mbedtls.c"}},{"signature_type":"Function","digest":{"length":3426,"function_hash":"322156640790580503829526878036975820535"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-4051d61c","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"Curl_ssl_peer_key_make","file":"lib/vtls/vtls_scache.c"}},{"signature_type":"Line","digest":{"line_hashes":["113039407112265038998765654552035572691","242913420036182063367940383239573004573","278973572554032248502284298391275979387","129941200059681863141753492878173145999","318577976057063368306539421088734378626"],"threshold":0.9},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-513cba53","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"file":"lib/ldap.c"}},{"signature_type":"Function","digest":{"length":492,"function_hash":"212697413827725388948767402678721080004"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-625a39c5","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"cf_ssl_scache_match_auth","file":"lib/vtls/vtls_scache.c"}},{"signature_type":"Line","digest":{"line_hashes":["80643577687604573429066753305061575978","194369058902949167218445409618414450795","301112568050706856132355632702528549347","104582360384520121153519823531766573930","256957385524087093005222928509745467212","260721047795024333920667785542625643544","310429472742867529852281268127234444004","140664390600350717219692565688579595799","96869374771762832369135955175068182552","87837397241283765394864353011207740617","303829844048966820270729648503870850712","122213521494725642778505319231400029364"],"threshold":0.9},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-680c786d","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"file":"lib/vssh/libssh.c"}},{"signature_type":"Line","digest":{"line_hashes":["181270230242809567009756638043169742680","209980567116188135588487189384331583976","273885960487946908476744038556708984114","49248109589978742382106569467149898057","322861117402775893138560920982070061331","144028553147728781970072522020302591125","276527356416977608547474121837581328378","163673092817957291096879750955809593326","48439208393128808325797198222909443716","5292753335004315430930261188396215662","282513269628630348948766750727767585337","233107998742682198289534274329256639866","262919725880543708549586890898945249959","218876329222855989524175466772121581834","291069068860828651872100873136875147862"],"threshold":0.9},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-70d46bfd","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"file":"lib/urldata.h"}},{"signature_type":"Function","digest":{"length":808,"function_hash":"124928086820281458324555561551868897579"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-7178fe2e","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"clone_ssl_primary_config","file":"lib/vtls/vtls.c"}},{"signature_type":"Function","digest":{"length":4419,"function_hash":"264762701548966124989245699776694146046"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-7410371e","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"Curl_ssl_easy_config_complete","file":"lib/vtls/vtls.c"}},{"signature_type":"Line","digest":{"line_hashes":["285865301448214901310043594818430009632","165017503388311822225368428963913131770","267076527656394390294488471714595188934","282895032685452778006797402316107330322","249672976881610510634107706169444990039","200479800068661522824637859624262138472","224477797927916845915021491884166806318","186735110968762527841013595567660748527","57981454056056313700286654092089256360","211566082279552544697784672934183852376","103711081373832036330033479743869539650","212168345440071108384720742483623748219","112341885940199143489869728841362371091","295679265441311819115222381403704684681","335666360367316234952871958379593667310","36186238934166933404895133084644810095","110556592254068947424986880540766661861"],"threshold":0.9},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-781a7dd2","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"file":"lib/vtls/schannel.c"}},{"signature_type":"Line","digest":{"line_hashes":["27869016268787505007846972844295097259","106171828960945990530346176224937589938","161483349965163629933900714134892156054"],"threshold":0.9},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-814b6a19","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"file":"lib/vtls/vtls_scache.h"}},{"signature_type":"Function","digest":{"length":4093,"function_hash":"191138660969734471579867520232719245537"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-86a606c4","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"mbed_configure_ssl","file":"lib/vtls/mbedtls.c"}},{"signature_type":"Function","digest":{"length":921,"function_hash":"70952655031714318064397442826955046006"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-8a28d818","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"cf_ssl_add_peer","file":"lib/vtls/vtls_scache.c"}},{"signature_type":"Function","digest":{"length":1387,"function_hash":"194704066241744887052641733493717648803"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-8ac7bfd7","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"match_ssl_primary_config","file":"lib/vtls/vtls.c"}},{"signature_type":"Function","digest":{"length":481,"function_hash":"112823091842400050074364866963206113549"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-8e306693","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"cf_ssl_scache_clear_peer","file":"lib/vtls/vtls_scache.c"}},{"signature_type":"Function","digest":{"length":1725,"function_hash":"145801252058214405522042574575711834750"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-8f462353","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"init_config_builder_client_auth","file":"lib/vtls/rustls.c"}},{"signature_type":"Line","digest":{"line_hashes":["139648805926239617519520232016833905817","183087726575497529273522795599540234149","88968464741428171571011357521289361947","272085787993596240103680845316053623293","198519629873628633394593794367278149121","279729464748783768388820679987726945443","266997753011297918992926778843761028901","235686775519643758529900985996019014936","289687720382082660623221690738425605140"],"threshold":0.9},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-943d0cba","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"file":"lib/vtls/openssl.c"}},{"signature_type":"Function","digest":{"length":4771,"function_hash":"242802535356130838472072196227723136027"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-9795d2da","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"get_client_cert","file":"lib/vtls/schannel.c"}},{"signature_type":"Function","digest":{"length":7978,"function_hash":"251726362032484936482476442955864224943"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-99c463ce","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"ldap_do","file":"lib/ldap.c"}},{"signature_type":"Function","digest":{"length":994,"function_hash":"330132591205480897785374893163179130889"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-9f5d86f0","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"cf_ssl_scache_peer_init","file":"lib/vtls/vtls_scache.c"}},{"signature_type":"Line","digest":{"line_hashes":["154028160645161306397776077923944794185","18822645313244226685295829346371255498","78371869204415636379715462914201771407","292899094926693804470083212892598447305","37659464735867337397241630700091825029","78559668193299868787330466383925872217","292346628075780853257762169651225809329","214000049100177761095203184667254182550","72221857498647661427756611000501922198","330939179641932111387428720422913292032","19042094289856033907102581860191366582","167876518684862366303934690856050394278","172705776036660961747981663640221841330","37659464735867337397241630700091825029","78559668193299868787330466383925872217","292346628075780853257762169651225809329","66554236948298936899726181451739218487","233427640935161181638390846899336624015","41738628622922494183493200140710486877","240723747878628896108150362059180136008"],"threshold":0.9},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-a082fda9","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"file":"lib/vtls/wolfssl.c"}},{"signature_type":"Line","digest":{"line_hashes":["21054647346384507892377623276020207956","255910819670120783385942806897650096362","15366925316261397217665336601751086359","176683949854557374164448495691502459788","45856990936582592720266902655643586958","113697784067858342069163874609347826484","93154871523718644199597127652770500270","280419077562609709259192306507522416292","52350101854180122938805362184651210365","9541861292011165980929513415706443694","181817044049698512091194699196323587686","326253106649779620760738428379100698152","239538362015617212866040732376864876308","19709675791145061559552496515675325184","159861103761800367034238290387748342021","103322999423095643466746538828605765796","13871233677174778956872254022712952342","200856859909085823976314829987647596198","158771579791679356574819319522755212842","101659210156436432947192642802281556863","139796361019768663339785504369259129277","295852362464225999141415198868068172380","175136205520922214954540717833272974561","240664442693156574290504096370444504193","174857213537792833158487526425264700379","183598008667046493141472097406459304153","53914854208304873979999960213836321330","4255112098031992478384804301337912386","211665031083587815903293227304656042431","278565130928762661344774194783179457808","280104416443090646614552393129189562320","202997142927621897517150811846807046695","175493048878056956552460324771893529885","144200512770454831412693971858363593361","255981172535163111454953462203322955956","68673281123511664433594718330838155339","264118582412589283960144720259057956584","163673791374620508843853131362680627629","158917866426044087441306935432175584024","113676063115754733892749203492267332763","198387256845075082393832253128451761696","37775737192923604234246588028581754172","148478314128555119715402296034441916089","289329447750920844263814446500727935735","166952640004655960612590703135675861184","270801133952586562389396574409419334902","100449166070024259145202243296021887670","3242636560839085572975530534624370903","21772754240803315653731399190964490989","57530952263566672770531421906500153815","31000275868366443018167458630300347418","104715317092347931206995816575215698785","334348344549747414427622816746152380082","155722594885463432352519287066685212549","286379277411887647479587259079968795466","3810397465318789924314242359634088952","59365913025733355572351338874817458139","86704689066105110295852096331839149499","334324944157751583636166628613417109632","56670654710260483921678743745233117605","272660415929746926575761080098193394914","294337654312068964470060064316290835153","63193725064819557838236445744977415703","339356179856099750763692455608481355306","223084217724351567859103186403477121641","9836864318692369435648615885441489690","218615140515642595067246855655293799376","22812652136396227402600390323624879216","319166438570279931786266450233883617797","117585823972304928818363397364762972185","218536147264057066697910974192034635078"],"threshold":0.9},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-bb011a3a","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"file":"lib/vtls/vtls_scache.c"}},{"signature_type":"Function","digest":{"length":216,"function_hash":"103758809396553412944798457145103091866"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-bd3dba0c","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"cf_ssl_cache_peer_update","file":"lib/vtls/vtls_scache.c"}},{"signature_type":"Function","digest":{"length":2138,"function_hash":"335750361397585050297239622418199114772"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-bd60fa6d","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"mbed_load_cacert","file":"lib/vtls/mbedtls.c"}},{"signature_type":"Line","digest":{"line_hashes":["63680271443118673340583303490677929635","25295578148269534496580282015256981257","251092589214536742569420088984708587526","303808097776044867491743115608901547226","138955379641196594386745978759081954107","316389251878985802159757931036509446071","223739395497036001591599360350990630520","303808097776044867491743115608901547226","1230011239008799301840488261754969914","184730254983917058343117271025887920663","74200977057609015810382050026223128257","283793968014865859603003752917524798052","337103460827073719055490329146091344700","259195190016384486716253875608797683741","170745052831324478055002393706357424865","295005068393002039710580010749440044378","278612883063918501976469184737216346764","152957887352325284518375119083252843197","165856999169062377074975292724686519137","41186269563069795523514592120770911458","205431018594345812687545218773951653148","276957636365209855843174966112576873429","24645885585976864069921312390194498221","283061227063551218008949292773699620870","238776002098889617921438550601367107329","186470420435547661159181517884717565052","94810953025715922310043587765812959002","10557209189641732960650248791964452403","96679677980377208520345062011335551410","5968622470152600891849480267823972216","31620918909212069346468137967768764383","259698913544789531263810761276259622199","230825315940662229481172796568073033326","45076675055265452634561024700564074467","266157986080888917763527653374601383743"],"threshold":0.9},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-be23c6d1","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"file":"lib/vtls/mbedtls.c"}},{"signature_type":"Function","digest":{"length":5683,"function_hash":"333896482370869401103594449766808456513"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-c20c5737","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"Curl_ossl_ctx_init","file":"lib/vtls/openssl.c"}},{"signature_type":"Line","digest":{"line_hashes":["2261316115968731167141485057459097947","218878064510094976839685685929466139563","129829612938398134073878903037467304112","302132349135155618468065530855674297989","325577645294600483704470611178050682928","218991936396188190751905558592166829380","285339658377942651109491721442483931835","262517950022613391291206703347677899337","99819243514244420436403008162133190844","278871627037554761294389438901669302199","10993914417656733560465763125234241573","258949413042078010646459209107476204983","211541907055670776715099572796923414053","192624272634694294458278594268065661742","5031075333697200889232422638667999537","111972068776020624040371682382725970727","180394632541853818516320263654631294473","112005113970071353567841224869211003613","100400864007877490508532885062748928276","54014629393632681267665329924174881938","112130096817272108921960945484631495392","326200095940088667947736971244162919158","211411195444718537885485402633711728560","197324248070166864587695624965990875450","15710514720387014553823428718851442468","7291275804895508235001766069930383818","337365318880941366839846000436764138172","137792359810422534611099734708980321153","283287686554360635043747036991481087067","333331296270853535582406311229558896171","41763277086006908062174009309533909857","115479653389130960422950848720213019390","89819942541541302729401439880082940809","287640939555238703607375020973819468953","136076646510923854311575367082848995687","90920917114946486082381111878524474910","52100338320107355546220399827765220926","266294334014596911934934594764893286081","184750210343204476998666398997031398581","297973853986999387601382898827722338280","262553743821213397431764916372803774436"],"threshold":0.9},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-d89ee88a","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"file":"lib/vtls/vtls.c"}},{"signature_type":"Function","digest":{"length":1265,"function_hash":"254830399638493341772478312232231081780"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-dc194fa8","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"myssh_in_AUTH_PKEY_INIT","file":"lib/vssh/libssh.c"}},{"signature_type":"Line","digest":{"line_hashes":["253856078298901279057669843917062199929","236648852106103825288428753310632603742","177239864025320514292778847116960173142","143750692224238965150587436843843453690","295094449840606997923801648016771094805","198068271115141439495464930277778487530","103970211698719919195007149548081945565","69635759116343817539151071819465321518","13469813334155406633463258912669837754","56038087730974851422214845987123568647","69948790958557668635129468877188497010","141173061205098551480311316399171743270","218091733005037266769441199866070989932","106891314413225368786825526267629632733","143895874252771187470230480495735122382","98809179647346624056168574853445980721","274140847310540377498512173205911024365","240023440402456849685681442384189145541","191405985725576352640977973536260875981","276916955575962265964214300728473740551"],"threshold":0.9},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-dd4707aa","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"file":"lib/vtls/rustls.c"}},{"signature_type":"Function","digest":{"length":4735,"function_hash":"31985418175801213350060953684438402315"},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-f3d8de0f","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"function":"gtls_client_init","file":"lib/vtls/gtls.c"}},{"signature_type":"Line","digest":{"line_hashes":["137004000350921581260165019766976272853","82230745369626625305696777816335373765","49604686216848521773931526581166017388","150198710160133243483536877660906993772","40713591620386689999929207011890309076","141335316865783088365390499161374166458","82563274532544210319609388695638201860","237616988876434478510812939028774640157","148641259302187665041055655553345715798","167280313770269775364220907328110012274","143877982550457113453028881635496011857","278607998740817607505219246497826895345","9756480148519625769379465689261118437","39116614586147455429555301909084209751","141541489072858482290726418002127610953","729922929140134971032400646926344189","185375298389212791383533616316421877568","270372699550450823029193386814194464164"],"threshold":0.9},"signature_version":"v1","deprecated":false,"id":"CURL-CVE-2026-8932-f453da64","source":"https://github.com/curl/curl.git/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e","target":{"file":"lib/vtls/gtls.c"}}],"vanir_signatures_modified":"2026-06-24T08:07:06Z","source":"https://curl.se/docs/CURL-CVE-2026-8932.json"}}],"schema_version":"1.7.5","credits":[{"name":"Joshua Rogers (Aisle Research)","type":"FINDER"},{"name":"Joshua Rogers (Aisle Research)","type":"REMEDIATION_DEVELOPER"}]}