libcurl retains the original CA trust configuration of a connection handle in its connection pool even after the handle is reconfigured to use custom CA certificates. As a result, subsequent requests made with the same handle continue to trust the native platform certificate store, which enables an attacker who can control the target server to present a certificate that would normally fail validation but is nonetheless accepted, permitting impersonation or interception of traffic.

The vulnerability affects the libcurl library, which is used by the cURL command‑line tool and many other applications. Red Hat Hummingbird, a server platform that incorporates libcurl, is also impacted. All libcurl releases that implement the standard connection‑pooling behaviour are susceptible; no specific version range is given.

The EPSS score is <1%, indicating a low probability of exploitation, yet the CVSS score of 9.1 classifies the vulnerability as critical. The most likely attack vector involves an attacker controlling a target server and reusing the same curl handle after the application switches to custom CA material, thereby exploiting the trust persistence. The vulnerability is not listed in CISA’s KEV catalog, but its potential impact warrants prompt remediation.