CVE-2026-80231 | HackTesting

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.

Credits

Stanislav Fort (Aisle Research)

Daniel Stenberg

References

https://curl.se/docs/CVE-2026-80231.json

https://curl.se/docs/CVE-2026-80231.html

https://hackerone.com/reports/3969368