Cyber Resilience

CVE-2026-9545

Haxx Curl 8.11.0 – 8.21.0

Public PoC
Published
03 July 2026
Modified
07 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0027 19th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-9545 is a high-severity an unspecified weakness vulnerability in Haxx Curl. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SC-8 (Transmission Confidentiality and Integrity) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When…

more

libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.

CWE(s)
NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
Why these techniques?

Vulnerability enables MITM impostor server to receive sensitive request data due to premature early data transmission before cert verification.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1557 Adversary-in-the-Middle Credential Accessconfidence: HIGH
The vulnerability allows an attacker to intercept and impersonate a legitimate server, enabling adversary-in-the-middle attacks to capture sensitive data sent via early data before certificate verification.
attack.mitre.org →
T1040 Network Sniffing Credential Accessconfidence: MEDIUM
The flaw permits network sniffing of sensitive information transmitted before TLS certificate validation occurs.
attack.mitre.org →
inferred from description · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-7009Same product: Haxx Curl
CVE-2026-8286Same product: Haxx Curl
CVE-2026-11564Same product: Haxx Curl
CVE-2026-7168Same product: Haxx Curl
CVE-2026-9547Same product: Haxx Curl
CVE-2026-4873Same product: Haxx Curl
CVE-2026-8932Same product: Haxx Curl
CVE-2025-5399Same product: Haxx Curl
CVE-2026-6429Same product: Haxx Curl
CVE-2025-10966Same product: Haxx Curl

Affected Assets

haxx
curl
8.11.0 — 8.21.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-8 Transmission Confidentiality and Integrity
  • SI-2 Flaw Remediation
  • CM-6 Configuration Settings
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SC-8 Transmission Confidentiality and Integrity good match
prevent

Directly requires confidentiality/integrity protections on transmitted data, which this CVE bypasses by sending early data before certificate verification.

SI-2 Flaw Remediation good match
prevent

Mandates timely remediation of software flaws such as the premature early-data send before cert validation in libcurl.

CM-6 Configuration Settings partial match
prevent

Enforces secure configuration of SSL/TLS options (e.g., disabling CURLSSLOPT_EARLYDATA or session caching) to avoid the vulnerable code path.

References