---
schema_version: '1.0'
id: security-20260705-cbda47
url: https://osv.dev/vulnerability/CURL-CVE-2026-8932
url_hash: cbda476abe8aea07839f4b4b4b3974089f1a7284a87df2858ee2d1432c4b0e15
canonical_url: https://osv.dev/vulnerability/CURL-CVE-2026-8932
source: osv:osv
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-8932
- CURL-CVE-2026-8932
- severity:Low
- https://github.com/curl/curl
- GIT
lang: en
published_at: '2026-06-24T08:00:00Z'
fetched_at: '2026-07-05T15:34:34Z'
updated_at: '2026-07-05T15:37:47Z'
status: published
content_hash: 7bca1f4bf8350e9e66e5c2f1bfa816182e1e54b003c6447544c4418f8aa41b4e
license_note: full
summary: incomplete mTLS config matching in conn reuse
summary_source: rss
summary_en: incomplete mTLS config matching in conn reuse
entities:
- name: GitHub
  type: organization
- name: config.yaml
  type: artifact
key_facts: []
related: []
related_auto:
- name: Anonymous
  type: organization
  weight: 1.0
- name: AirPods
  type: artifact
  weight: 1.0
- name: Claude Code
  type: artifact
  weight: 1.0
- name: セッション漏洩
  type: event
  weight: 1.0
- name: local-llm
  type: content
  weight: 1.0
title: 'CVE-2026-8932: incomplete mTLS config matching in conn reuse'
---

# CVE-2026-8932: incomplete mTLS config matching in conn reuse

## TL;DR
incomplete mTLS config matching in conn reuse

## Key Points
- cve / CVE-2026-8932 / CURL-CVE-2026-8932 / severity:Low / https://github.com/curl/curl / GIT

## Details
**Severity:** Low
**Advisory:** CURL-CVE-2026-8932 (CVE-2026-8932)

**Affected (your watchlist):**
- `GIT:https://github.com/curl/curl` curl-8_9_1 → no fixed version listed [mac]

**Details:**
libcurl would reuse a previously created connection even when some mTLS config
related option had been changed that should have prohibited reuse.

libcurl keeps previously used connections in a connection pool for subsequent
transfers to reuse if one of them matches the setup. However, some TLS
settings related to client certificates were left out from the configuration
match checks, making them match too easily. In particular options related to
the private key.

_Data: OSV.dev (upstream: osv) — https://osv.dev/vulnerability/CURL-CVE-2026-8932_

## Source
元記事: [CVE-2026-8932: incomplete mTLS config matching in conn reuse](https://osv.dev/vulnerability/CURL-CVE-2026-8932) — published 2026-06-24T08:00:00Z