When libcurl uses the wolfSSL backend with CA caching enabled, a user‑supplied callback intended to replace the trust store can be silently ignored. After the callback returns, the cached store is re‑installed, so a certificate that the cached store trusts but the callback’s store rejects is incorrectly accepted. This flaw permits an attacker to subvert custom certificate validation logic and gain unauthorized trust in a malicious server. The compromised connection can be used for credential theft, data exfiltration or further lateral movement.

Affected systems are instances of libcurl that employ the wolfSSL backend with CA caching turned on. The CVE record lists the product as curl:curl, but no specific version ranges are supplied. Consequently, any build of libcurl using wolfSSL with caching enabled is potentially affected until a fix is deployed.

The vulnerability can be exploited by an attacker who can supply a server certificate that is present in the cached store but is not accepted by the application’s custom trust logic. Because the bug restores the cached store automatically, the attacker can maintain a legitimate TLS connection despite having a policy that would otherwise reject it. No EPSS score is available, and the issue is not listed in CISA KEV, but the flaw facilitates a dangerous bypass of authentication and should be treated as a high‑risk issue once the application contacts a malicious endpoint.