CVE-2026-86415

Discovered by AISLEPUBLISHEDCWE-201

Description

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.

CVSS Base Scores

CVSS v3.1(Primary)
3.7

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected Products

VendorProductVersionStatus
curl——

References