The curl library exhibits a flaw when the CURLOPT_INTERFACE option is set with prefixes if!, host!, or ifhost!. The binding is omitted from the connection reuse key, allowing a later request that specifies a different source to consume a cached connection and send data over the earlier connection's source address. Consequently, traffic that should originate from a designated interface can emerge from an unintended interface, potentially exposing data to unauthorized networks and violating policy constraints. The flaw is secondary in impact but can introduce subtle security and compliance risks. The CVSS score of 8.1 indicates a high severity assessment, but misrouting can still create undesirable effects.

Any installation of the curl library that uses connection pooling in conjunction with forced local interface binding options is potentially susceptible. No specific version range is reported, so all builds employing this pattern may be affected until a fix is applied.

The CVSS score of 8.1 indicates a high severity problem; the EPSS score is below 1%, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a client‑side application that initiates network requests using pooled connections with forced interface binding. Based on the description, it is inferred that an attacker would need to influence the application’s network activity; no publicly known exploitation cases exist. Consequently, exploitation is considered unlikely without direct interaction with the affected application, though the risk of inadvertent misrouting remains present.