High [CVE-2026-8932] Security feature bypass due to improper mTLS connection reuse

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.

However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections.

This occurred even when changes to mutual Transport Layer Security (mTLS) settings, particularly those for client certificates, should have prevented such reuse.

This issue could lead to a security feature bypass, where a client might use a connection with an unintended or weaker security configuration, potentially compromising the integrity or confidentiality of data. This is an Important security feature bypass in libcurl where mTLS connection reuse may occur despite changes to client certificate settings.

This could lead to applications using libcurl with mTLS to inadvertently use a less secure connection than intended, potentially compromising data confidentiality or integrity.