libcurl keeps established connections in a pool for reuse. When an application changes client‑certificate or private‑key settings, the library excludes private‑key parameters from its configuration‑match check, so the altered settings still match an old connection. This gap allows an attacker who can modify the client‑certificate configuration between requests to reuse a previously authenticated TLS session that was established with a different certificate or key, thereby impersonating a legitimate client. The vulnerability is classified as CWE‑1025, a configuration mismatch that leads to unintended reuse of secure connections.

The affected product is libcurl, used in many programs that perform mutual TLS. Any system that relies on libcurl for mTLS and does not run a patched version may be vulnerable when the client certificate or private key is changed between connections. Vendor‑specific version information is not supplied in the CNA data, so all unpatched libcurl releases are potentially affected.

The EPSS score of <1% shows a very low exploitation probability, yet the CVSS score of 7.5 indicates a high impact should the flaw be exploited. Based on the description, it is inferred that the attacker could influence client‑certificate settings between requests, meaning the likely attack vector involves an attacker who can manipulate these settings to trigger libcurl to reuse a previously established connection. This can enable reuse of a secured connection and bypass mutual‑TLS authentication. The vulnerability is not listed in CISA KEV, but the impact can expose confidential data and grant unauthorized access to services that require client certificates.