local interface connection reuse mixup
======================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-107929.html)

VULNERABILITY
-------------

When `CURLOPT_INTERFACE` (or the command line tool's `--interface' option) is
set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that
binding is not part of the connection reuse key, so a later transfer asking
for a different source can silently reuse an existing connection and go out
from the earlier transfer's source address

INFO
----

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-107929 to this issue.

CWE-488: Exposure of Data Element to Wrong Session

Severity: Low

This bug is not considered a *C mistake* (likely to have been avoided had we
not been using C).

AFFECTED VERSIONS
-----------------

- Affected versions: curl 8.9.0 to and including 8.22.0
- Not affected versions: curl < 8.9.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/3060557af702dd59155e

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/d37d79df1e01066417aff0a9e

RECOMMENDATIONS
---------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Avoid `CURLOPT_INTERFACE` and `--interface`

TIMELINE
--------

This issue was reported to the curl project on October 9, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Maksim
- Patched-by: Stefan Eissing

Thanks a lot!