CVE-2026-9545 - Vulnerability Details

Description

In this scenario, libcurl first uses a proper HTTP/3 server for the initial
transfers, and when it makes a second transfer to the same site it has been
replaced by the attacker's impostor machine - without a valid certificate.

When libcurl returns to the hostname the second time with a cached SSL session
(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the
`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might
send off the second request's bytes on that new connection *before* enforcing
the certificate verification failure. Potentially leaking sensitive
information.

Published: 2026-07-03

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises from libcurl’s handling of HTTP/3 early data while an SSL session cache remains active. If an attacker replaces the server after a first successful transfer, libcurl might send the early‑data bytes of a subsequent request over the new connection before certificate verification fails, potentially leaking sensitive information. This flaw represents an authentication bypass (CWE‑295).

Affected Systems

The single affected product is libcurl as distributed by curl:curl. No version range is specified in the CVE entry, so any installation that uses the early‑data handling logic can be impacted if the SSL session cache and early‑data modes are enabled.

Risk and Exploitability

Clients that have early data enabled and SSL session caching active are susceptible. An adversary capable of impersonating the server after the SSL session cache has been populated can receive the early data before the certificate check is performed. The CVSS score of 7.5 indicates a high severity level, while the EPSS score of < 1% suggests that exploitation is currently considered low but possible. The vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

curl

unaffected

Version	Status	Constraints
`8.20.0`	affected	≤ 8.20.0
`8.19.0`	affected	≤ 8.19.0
`8.18.0`	affected	≤ 8.18.0
`8.17.0`	affected	≤ 8.17.0
`8.16.0`	affected	≤ 8.16.0
`8.15.0`	affected	≤ 8.15.0
`8.14.1`	affected	≤ 8.14.1
`8.14.0`	affected	≤ 8.14.0
`8.13.0`	affected	≤ 8.13.0
`8.12.1`	affected	≤ 8.12.1
`8.12.0`	affected	≤ 8.12.0
`8.11.1`	affected	≤ 8.11.1
`8.11.0`	affected	≤ 8.11.0

Configuration 1 [-]

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Curl

100%

Version	Status	Scheme	Platform
`8.20.0`	affected	semver	—
`8.19.0`	affected	semver	—
`8.18.0`	affected	semver	—
`8.17.0`	affected	semver	—
`8.16.0`	affected	semver	—
`8.15.0`	affected	semver	—
`8.14.1`	affected	semver	—
`8.14.0`	affected	semver	—
`8.13.0`	affected	semver	—
`8.12.1`	affected	semver	—
`8.12.0`	affected	semver	—
`8.11.1`	affected	semver	—
`8.11.0`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a libcurl release that replaces or removes the CURLSSLOPT_EARLYDATA option to prevent early data from being sent before certificate validation.
Disable SSL session caching by setting CURLOPT_SSL_SESSIONID_CACHE to 0 for any connections that require strict certificate verification.
If upgrading is not immediately possible, temporarily disable HTTP/3 support or early data by configuring the appropriate libcurl options until a patch is available.

Generated by OpenCVE AI on August 1, 2026 at 20:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8487-1	curl vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00268.

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://curl.se/docs/CVE-2026-9545.html
https://curl.se/docs/CVE-2026-9545.json
https://hackerone.com/reports/3752888
https://nvd.nist.gov/vuln/detail/CVE-2026-9545
https://www.cve.org/CVERecord?id=CVE-2026-9545

History

Tue, 07 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-295
References		https://nvd.nist.gov/vuln/detail/CVE-2026-9545 https://www.cve.org/CVERecord?id=CVE-2026-9545
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 06 Jul 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 06 Jul 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-200 CWE-287

Mon, 06 Jul 2026 01:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200 CWE-287

Sun, 05 Jul 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-200

Sun, 05 Jul 2026 05:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200

Sat, 04 Jul 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-287

Sat, 04 Jul 2026 01:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-287

Fri, 03 Jul 2026 21:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-200

Fri, 03 Jul 2026 10:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200

Fri, 03 Jul 2026 08:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Curl Curl curl
Vendors & Products		Curl Curl curl

Fri, 03 Jul 2026 06:45:00 +0000

Type	Values Removed	Values Added
Description		In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection before enforcing the certificate verification failure. Potentially leaking sensitive information.
Title		exposing HTTP/3 early data
References		https://curl.se/docs/CVE-2026-9545.html https://curl.se/docs/CVE-2026-9545.json https://hackerone.com/reports/3752888

Subscriptions

Curl Curl

Haxx Curl

MITRE

Status: PUBLISHED

Assigner: curl

Published: 2026-07-03T06:17:55.931Z

Updated: 2026-07-06T16:53:23.396Z

Reserved: 2026-05-26T06:45:08.680Z

Link: CVE-2026-9545

Vulnrichment

Updated: 2026-07-06T16:53:19.588Z

NVD

Status : Analyzed

Published: 2026-07-03T07:16:25.807

Modified: 2026-07-07T15:03:56.920

Link: CVE-2026-9545

Redhat

Severity : Important

Publid Date: 2026-07-03T06:17:55Z

Links: CVE-2026-9545 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-01T20:45:05Z

Weaknesses

CWE-295
Improper Certificate Validation
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation poc

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object