The curl library contains a flaw that occurs when connection pooling is combined with forced local interface binding options. The flaw prevents the library from storing the source interface configuration in its connection reuse cache. When a connection is reused without this information, the outgoing traffic may be transmitted through an unintended network interface, potentially violating organization policies or exposing data to unauthorized networks. The vulnerability’s low CVSS score of 3.7 indicates a limited impact scope, but misrouting can still introduce subtle security and compliance risks.

Any installation of the curl library that uses connection pooling in conjunction with forced local interface binding options is potentially susceptible. No specific version range is reported, so all builds employing this pattern may be affected until a fix is applied.

The CVSS score of 3.7 reflects a low severity assessment; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a client‑side application that initiates network requests using pooled connections with forced interface binding. Based on the description, it is inferred that an attacker would need to influence the application’s network activity; no publicly known exploitation cases exist. Consequently, exploitation is considered unlikely without direct interaction with the affected application, though the risk of inadvertent misrouting remains present.