Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-8932 →
Catégories
DEBIAN-CVE-2026-8932

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. lib...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 curl
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13 curl
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14 curl
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.21.0~rc2-1"}]}]

Références

Nous utilisons des cookies pour l'analyse d'audience et la mesure publicitaire. Ce réglage s'applique à tous les sites de Game co., Ltd. En savoir plus