Bug 2496759 (CVE-2026-8932)

Summary: CVE-2026-8932 libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, bbrownin, csutherl, dbosanac, dpaolell, gtanzill, jbuscemi, jclere, jdelft, jmitchel, jreimann, jupierce, kshier, lgarciaa, mbiarnes, mdessi, mrizzi, pcattana, pjindal, plodge, ppalepu, ppostler, prdhamdh, rekumar, rhel-process-autobot, sdawley, sghai, sidsharm, stcannon, suppawar, szappis, teagle, vchlup, vlaad, vvoronko, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security (mTLS) settings, particularly those for client certificates, should have prevented such reuse. This issue could lead to a security feature bypass, where a client might use a connection with an unintended or weaker security configuration, potentially compromising the integrity or confidentiality of data.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2497470, 2509772    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-03 07:01:37 UTC 
libcurl would reuse a previously created connection even when some mTLS config
related option had been changed that should have prohibited reuse.

libcurl keeps previously used connections in a connection pool for subsequent
transfers to reuse if one of them matches the setup. However, some TLS
settings related to client certificates were left out from the configuration
match checks, making them match too easily. In particular options related to
the private key.
Comment 4 errata-xmlrpc 2026-08-19 13:28:42 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Core Services 2.4.62.SP5

Via RHSA-2026:56869 https://access.redhat.com/errata/RHSA-2026:56869