---
schema_version: '1.0'
id: security-20260709-481e8f
url: https://osv.dev/vulnerability/CVE-2026-8932
url_hash: 481e8f1637e971d28fdc86379a8518f0c75f560fafc24f3cb90d741cfe40e449
canonical_url: https://osv.dev/vulnerability/CVE-2026-8932
source: osv:nvd
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-8932
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- https://github.com/curl/curl
- GIT
lang: en
published_at: '2026-07-03T06:16:30Z'
fetched_at: '2026-07-09T15:38:26Z'
updated_at: '2026-07-09T15:38:50Z'
status: published
content_hash: ad8e5857975956a78a079cfe30ec59449b4bf3b26a03d442e66e7426ff56c4e8
license_note: full
summary: incomplete mTLS config matching in conn reuse
summary_source: rss
summary_en: incomplete mTLS config matching in conn reuse
entities:
- name: CVE-2022-26925
  type: event
- name: GitHub
  type: organization
- name: config.yaml
  type: artifact
- name: ConnectionPooler
  type: concept
key_facts: []
related: []
related_auto:
- name: GitLost
  type: concept
  weight: 4.0
- name: Windowsローカルセキュリティ認証機関(LSA
  type: location
  weight: 1.0
- name: AI Agent
  type: concept
  weight: 1.0
- name: Hy3
  type: artifact
  weight: 1.0
- name: OpenClaw
  type: artifact
  weight: 1.0
title: 'CVE-2026-8932: incomplete mTLS config matching in conn reuse'
---

# CVE-2026-8932: incomplete mTLS config matching in conn reuse

## TL;DR
incomplete mTLS config matching in conn reuse

## Key Points
- cve / CVE-2026-8932 / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N / https://github.com/curl/curl / GIT

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
**Advisory:** CVE-2026-8932

**Affected (your watchlist):**
- `GIT:https://github.com/curl/curl` curl-8_9_1 → no fixed version listed [mac]

**Details:**
libcurl would reuse a previously created connection even when some mTLS config
related option had been changed that should have prohibited reuse.

libcurl keeps previously used connections in a connection pool for subsequent
transfers to reuse if one of them matches the setup. However, some TLS
settings related to client certificates were left out from the configuration
match checks, making them match too easily. In particular options related to
the private key.

**References:**
- https://curl.se/docs/CVE-2026-8932.html
- https://curl.se/docs/CVE-2026-8932.json
- https://hackerone.com/reports/3733910
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8932.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-8932

_Data: OSV.dev (upstream: nvd) — https://osv.dev/vulnerability/CVE-2026-8932_

## Source
元記事: [CVE-2026-8932: incomplete mTLS config matching in conn reuse](https://osv.dev/vulnerability/CVE-2026-8932) — published 2026-07-03T06:16:30Z