Description
In this scenario, libcurl first uses a proper HTTP/3 server for the initial
transfers, and when it makes a second transfer to the same site it has been
replaced by the attacker's impostor machine - without a valid certificate.

When libcurl returns to the hostname the second time with a cached SSL session
(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the
`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might
send off the second request's bytes on that new connection *before* enforcing
the certificate verification failure. Potentially leaking sensitive
information.
Published: 2026-07-03
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Data Exposure
Action: Patch
AI Analysis

Impact

The vulnerability arises from libcurl’s handling of HTTP/3 early data while an SSL session cache remains active. If an attacker replaces the server after a first successful transfer, libcurl might send the early‑data bytes of a subsequent request over the new connection before certificate verification fails a data exposure vulnerability.

Affected Systems

The single affected product is libcurl as distributed by curl:curl. No version range is specified in the CVE entry, so any installation that uses the early‑data session enabled.

Risk and Exploitability

Clients that have early data enabled and SSL session caching active are susceptible. An adversary capable of impersonating the server after the SSL session cache has been populated can receive the early data before the certificate check is performed. The CVSS score of 7.5 indicates a high severity level, while the EPSS score of < 1% suggests that exploitation is currently considered low but possible. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on September 21, 2026 at 07:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a libcurl release that fixes the early-data handling bug, ensuring that early data is not transmitted before certificate verification.
  • Disable SSL session caching by setting CURLOPT_SSL_SESSIONID_CACHE to 0 for any connections that require strict certificate verification.
  • If upgrading is not immediately possible, temporarily disable HTTP/3 support or early data by configuring the appropriate libcurl options until a patch is available.

Generated by OpenCVE AI on September 21, 2026 at 07:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8487-1 curl vulnerabilities
History

Tue, 15 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Tue, 07 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-295
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 06 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-287

Mon, 06 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-287

Sun, 05 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Sun, 05 Jul 2026 05:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Sat, 04 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287

Sat, 04 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287

Fri, 03 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Fri, 03 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Fri, 03 Jul 2026 08:00:00 +0000

Type Values Removed Values Added
First Time appeared Curl
Curl curl
Vendors & Products Curl
Curl curl

Fri, 03 Jul 2026 06:45:00 +0000

Type Values Removed Values Added
Description In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.
Title exposing HTTP/3 early data
References

Subscriptions

Curl Curl
Haxx Curl
cve-icon MITRE

Status: PUBLISHED

Assigner: curl

Published:

Updated: 2026-09-15T06:03:31.804Z

Reserved: 2026-05-26T06:45:08.680Z

Link: CVE-2026-9545

cve-icon Vulnrichment

Updated: 2026-07-06T16:53:19.588Z

cve-icon NVD

Status : Modified

Published: 2026-07-03T07:16:25.807

Modified: 2026-09-15T07:16:34.947

Link: CVE-2026-9545

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-03T06:17:55Z

Links: CVE-2026-9545 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T07:45:11Z

Weaknesses