8.1

CVE-2026-8286

Exploit

wrong STARTTLS connection reuse

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the
connection might reuse an existing live connection even though the TLS
configuration mismatches so it should not.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Haxx ≫ Curl Version >= 7.30.0 < 8.21.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.31% 0.232
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

https://hackerone.com/reports/3718195
Third Party Advisory
Exploit
Issue Tracking
https://curl.se/docs/CVE-2026-8286.html
Patch
Vendor Advisory
https://curl.se/docs/CVE-2026-8286.json
Vendor Advisory