A flaw in libcurl causes the library to reuse an existing HTTPS connection even when the Native CA Store setting differs from the configuration used when the connection was established. Because the client does not re‑validate the certificate chain under the new CA store constraints, an attacker could present a certificate that would otherwise be rejected, potentially enabling man‑in‑the‑middle attacks.

The vulnerability affects any use of the curl:curl library where HTTPS connections are established with the CURLSSLOPT_NATIVE_CA option and later changed between requests. No specific version numbers are supplied, so all releases prior to the official fix should be considered vulnerable.

The flaw is a client‑side bug that could be exploited by an attacker who controls the target hostname and can provide a certificate that satisfies the original CA store but not the updated one. The exploitation would require the client to reuse a connection with differing CA store settings. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, making the current exploitation likelihood uncertain. No CVSS score is reported, but the weakness corresponds to improper certificate validation, which is potentially high severity.