Cyber Resilience

CVE-2026-8932

Haxx Curl 7.7 – 8.21.0

Public PoC
Published
03 July 2026
Modified
07 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0040 32th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-8932 is a high-severity an unspecified weakness vulnerability in Haxx Curl. Its CVSS base score is 7.5 (High).

Operationally, ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them…

more

matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

CWE(s)
NVD-CWE-Other

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.
Confidence: LOW · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1550.001 Application Access Token Lateral Movementconfidence: MEDIUM
Reusing a pooled TLS connection with stale client-certificate settings could allow an attacker to leverage previously obtained application access tokens or credentials without proper re-authentication.
attack.mitre.org →
inferred from description · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-5399Same product: Haxx Curl
CVE-2026-6429Same product: Haxx Curl
CVE-2025-10966Same product: Haxx Curl
CVE-2026-7009Same product: Haxx Curl
CVE-2025-14017Same product: Haxx Curl
CVE-2025-13034Same product: Haxx Curl
CVE-2024-9681Same product: Haxx Curl
CVE-2026-5545Same product: Haxx Curl
CVE-2026-8924Same product: Haxx Curl
CVE-2026-8286Same product: Haxx Curl

Affected Assets

haxx
curl
7.7 — 8.21.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-8 Transmission Confidentiality and Integrity
  • CM-6 Configuration Settings
  • IA-5 Authenticator Management
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SC-8 Transmission Confidentiality and Integrity good match
prevent

Directly enforces transmission confidentiality/integrity via proper mTLS client certificate and private-key settings, blocking reuse of connections whose TLS config no longer matches.

CM-6 Configuration Settings good match
prevent

Requires correct configuration settings for TLS client certificates and keys so that connection-pool matching logic cannot ignore changed mTLS parameters.

IA-5 Authenticator Management partial match
prevent

Mandates proper management and binding of private keys and authenticators, ensuring certificate-related options are part of any connection-reuse decision.

References