When libcurl uses the wolfSSL backend with CA caching enabled, a user‑supplied callback intended to replace the trust store can be silently ignored. After the callback returns, the cached store is re‑installed, so a certificate that the cached store trusts but the callback’s store rejects is incorrectly accepted. This flaw is an instance of CWE-295 (Improper Validation of Certificates), and it permits an attacker to subvert custom certificate validation logic and gain unauthorized trust in a malicious server. The compromised connection can be used for credential theft, data exfiltration or further lateral movement.

Affected systems are instances of libcurl that employ the wolfSSL backend with CA caching turned on. The CVE record lists the product as curl:curl, but no specific version ranges are supplied. Consequently, any build of libcurl using wolfSSL with caching enabled is potentially affected until a fix is deployed.

The likely attack vector is a malicious server presenting a certificate that is accepted by the cached store but rejected by the custom trust logic supplied via CURLOPT_SSL_CTX_FUNCTION. The vulnerability can be exploited by an attacker who can supply such a server certificate. Because the bug restores the cached store automatically, the attacker can maintain a legitimate TLS connection despite having a policy that would otherwise reject it. The EPSS score indicates a low, but non‑zero probability of exploitation (< 1%). The CVSS score of 7.5 reflects high severity. The issue is not listed in CISA KEV, but the flaw facilitates a dangerous bypass of authentication and should be treated as a high‑risk issue once the application contacts a malicious endpoint.