libcurl keeps established connections in a pool for reuse. When an application changes client‑certificate or private‑key settings, the library excludes private‑key parameters from its configuration‑match check, so the altered settings still match an old connection. This gap allows an attacker who can modify the client‑certificate configuration between requests to reuse a previously authenticated TLS session that was established with a different certificate or key, thereby impersonating a legitimate client. The vulnerability is classified as CWE‑1025, a configuration mismatch that leads to unintended reuse of secure connections.

The affected product is libcurl, used in many programs that perform mutual TLS. Any system that relies on libcurl for mTLS and does not run a patched version may be vulnerable when the client certificate or private key is changed between connections. Vendor‑specific version information is not supplied in the CNA data, so all unpatched libcurl releases are potentially affected.

The EPSS score of <1% shows a very low exploitation probability, yet the CVSS score of 7.5 indicates a high impact should the flaw be exploited. The risk is compounded when an attacker can influence client‑certificate settings between requests, enabling them to reuse a secured connection and bypass mutual‑TLS authentication. The vulnerability is not listed in CISA KEV, but the impact can expose confidential data and grant unauthorized access to services that require client certificates.