A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.CreditsAndrew Nesbitt (powered by Mythos)Stefan EissingReferenceshttps://curl.se/docs/CVE-2026-8286.jsonhttps://curl.se/docs/CVE-2026-8286.htmlhttps://hackerone.com/reports/3718195
