A flaw in libcurl causes the library to reuse an existing HTTPS connection even when the Native CA Store setting has changed between the connection’s creation and its subsequent use. Because the CA store is not re‑validated in this circumstance, a certificate that would normally be rejected can be accepted, resulting in improper certificate validation. The weakness aligns with CWE‑295 and CWE‑488 and could enable attackers to perform a Man-in-the-Middle attack if they can supply a certificate that satisfies the older CA store but not the newer one.

All installations of the libcurl library distributed by haxx, including any applications that link to curl, and any RedHat Hummingbird version that bundles libcurl (e.g., RedHat Hummingbird 1), are potentially affected. The advisory does not list specific version numbers; therefore any libcurl instance using the CURLSSLOPT_NATIVE_CA option without the official fix can be vulnerable.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score is less than 1% and the issue is not listed in the CISA KEV catalog, suggesting that exploitation is presently unlikely. Based on the description, it is inferred that an attacker must control a target hostname, manipulate the certificate chain, and trigger a reuse of an HTTPS connection after the Native CA Store setting has changed. The attack surface is limited to scenarios where the client reuses connections across different CA store configurations, but a successful MITM remains possible when these conditions are met.