libcurl allows a single connection handle to retain its original trust configuration in a connection pool, even after that handle is reconfigured to use custom CA certificates. This means that subsequent requests made with the same handle can continue to trust the native platform certificate store, despite the change to a different root authority. The flaw, classified as CWE‑295, enables an attacker who can control the target server to present a certificate that would normally fail validation but is nonetheless accepted, effectively allowing impersonation or interception of traffic.

The affected component is the libcurl library, widely used in the cURL command‑line tool and many other applications. Red Hat Hummingbird, a server platform that incorporates libcurl, is also impacted. All libcurl releases that implement the standard connection‑pooling behaviour are susceptible, though no specific version range is provided.

The likelihood of exploitation is low, with an EPSS score of < 1 %; however, the CVSS score of 9.1 classifies the vulnerability as critical and the effect would be severe if an attacker can control the target server and reuse the same curl handle after a trust‑store change. The attack vector is inferred from the description: an attacker must supply a malicious certificate to a vulnerable application that has reused the same handle after reconfiguring its CA store. The vulnerability is not currently listed in CISA’s KEV catalog, but the seriousness of the potential exploit warrants high‑priority remediation.