libcurl maintains a pool of established TLS sessions that can be reused for performance. This vulnerability stems from the omission of client‑certificate‑related options, such as the private key, from the pool‑matching logic. When an application changes its client‑certificate or private‑key configuration between requests, libcurl may still consider a previously established connection a match and reuse it. The attacker can thus bind an authenticated TLS session that was originally established with one credential to a different set of credentials, effectively impersonating the authorised client. This behaviour corresponds to CWE-1025 and CWE-305.

The affected product is the libcurl library, part of the curl project. All releases prior to the patch that fixes the configuration‑matching defect are vulnerable if an application alters the client‑certificate or private‑key settings between successive connections. The data does not specify particular version numbers.

The CVSS score of 7.5 denotes high potential impact. The EPSS score of <1% indicates a very low current exploitation probability, yet the vulnerability remains a risk in environments where client‑certificate settings are modified or where connection reuse is unrestricted. The vuln is not listed in CISA’s KEV catalog. An attacker with the ability to manipulate client‑certificate configuration between requests could exploit the reuse bug to bypass mutual TLS authentication. The likely attack vector is through an application that controls the client‑certificate parameters or by altering configuration files that libcurl consumes.