The curl library’s STARTTLS implementation allows a new transfer to reuse an existing live connection even when the TLS configuration does not match, meaning the upgrade may occur without the intended security guarantees. As a result, data transmitted after the STARTTLS command could be sent over a channel that is not fully protected, potentially exposing or allowing modification of information that should be confidential and integrity‑protected. The flaw is a TLS renegotiation issue classified as CWE‑295.

This issue affects the curl library (libcurl) used by applications that perform STARTTLS operations. No specific version ranges are mentioned, so any build of libcurl that implements STARTTLS could be susceptible. Operators using libcurl should verify the version and look for updates that address this flaw.

The CVSS score of 8.1 indicates high severity, but the EPSS score of less than 1% suggests a low but non‑zero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require an attacker to influence the server or network path to trigger a STARTTLS upgrade that reuses a mismatched connection; this scenario is inferred and would likely involve a malicious or misconfigured server or a man‑in‑the‑middle attack. Consequently, the overall risk is moderate, driven largely by the high severity of the potential data compromise.