Bug 2550721 (CVE-2026-107929)

Summary:	CVE-2026-107929 curl: curl: local interface connection reuse mixup
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	anthomas, csutherl, ehelms, ggainey, jclere, jpasqual, juwatts, mdellweg, mhulan, nmoumoul, osousa, pcreech, pjindal, plodge, rchan, rekumar, rhel-process-autobot, security-response-team, smallamp, szappis, tmalecek, vchlup, vvoronko, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in curl. When connection pooling is used with forced local interface binding options, curl fails to include the source interface configuration in its connection reuse cache. An attacker able to initiate network requests in an application using pooled connections can cause subsequent transfers to inadvertently reuse an existing connection. This behavior causes outbound network traffic to be transmitted through the wrong source address, potentially routing requests through an unintended network interface.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-10-14

Description OSIDB Bzimport 2026-10-13 17:38:13 UTC

local interface connection reuse mixup
======================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-107929.html)

VULNERABILITY
-------------

When `CURLOPT_INTERFACE` (or the command line tool's `--interface' option) is
set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that
binding is not part of the connection reuse key, so a later transfer asking
for a different source can silently reuse an existing connection and go out
from the earlier transfer's source address

INFO
----

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-107929 to this issue.

CWE-488: Exposure of Data Element to Wrong Session

Severity: Low

This bug is not considered a *C mistake* (likely to have been avoided had we
not been using C).

AFFECTED VERSIONS
-----------------

- Affected versions: curl 8.9.0 to and including 8.22.0
- Not affected versions: curl < 8.9.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/3060557af702dd59155e

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/d37d79df1e01066417aff0a9e

RECOMMENDATIONS
---------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Avoid `CURLOPT_INTERFACE` and `--interface`

TIMELINE
--------

This issue was reported to the curl project on October 9, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Maksim
- Patched-by: Stefan Eissing

Thanks a lot!