libcurl keeps established connections in a connection pool to speed up subsequent transfers. When an application changes options related to client certificates or private keys, the library incorrectly treats the connection as a match because it omits private‑key‑related configuration from the comparison. This flaw allows a malicious actor who can influence the client‑certificate configuration to reuse a previously established TLS session even after the certificate or private key has been changed, thereby potentially impersonating another authenticated client to a server that requires mutual TLS. The weakness is classified as CWE‑1025, a configuration mismatch that leads to the unintended reuse of secure connections.

The affected product list identifies curl:curl in the CNA data. Any system that uses libcurl for mutual TLS and does not run a patched version may be vulnerable when client certificates or private keys are altered between connections. Detailed version information is not supplied by the CNAs for the affected releases.

The EPSS metric indicates a very low exploitation probability (<1%). The CVSS score of 7.5 reflects a high impact and medium to high exploitability. The flaw is not listed in CISA KEV. Based on the description, the likely attack vector is an attacker who can influence the client‑certificate or private‑key settings between requests – allowing libcurl to incorrectly reuse an authenticated TLS session that was originally established with a different certificate or key. This bypasses client authentication and could expose confidential traffic. libcurl performs persistent connection reuse for mutual TLS, so such misuse can lead to impersonation or session hijacking.