The vulnerability arises in libcurl’s handling of HTTP/3 early data. A legitimate server is contacted initially, but an attacker can later impersonate the same hostname without a valid certificate. Because SSL session caching is enabled and the early‑data option is active, libcurl may transmit the early‑data bytes on the forged connection before the client detects the missing or invalid certificate, leading to the accidental disclosure of sensitive information.

The single affected product is libcurl as distributed by curl:curl. No version range is specified in the CVE entry, so any installation that uses the early‑data handling logic can be impacted if the SSL session cache and early‑data modes are enabled.

Clients with early data enabled and SSL session caching active are susceptible. An adversary capable of intercepting or impersonating the server after the SSL session cache has been populated can receive the early data before the certificate check is performed. The CVSS score of 7.5 indicates a high severity level, while the EPSS score of < 1% suggests that exploitation is currently considered low but possible. The vulnerability is not listed in the CISA KEV catalog.