CVE-2026-80231

CVE-2026-80231 is a connection-management flaw in libcurl: when a transfer requests the Native CA Store option (CURLSSLOPT_NATIVE_CA), libcurl may wrongly reuse an existing HTTPS connection to the same hostname that was originally established with a different Native CA Store setting. It is triggered when one application performs multiple HTTPS requests to the same host through the same connection cache while the CURLSSLOPT_NATIVE_CA setting differs between transfers, so the reused connection's certificate-verification context does not match what the new transfer asked for. Per the published CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the impact is availability only, meaning the mismatch can disrupt or crash the affected application (denial of service); no confidentiality or integrity impact is scored, and the flaw is tracked as CWE-488 (exposure of data element to wrong session). Anyone embedding or linking an affected libcurl and using the Native CA Store feature is exposed. Exploitation status is currently 'none known': there is no public PoC, it is not in CISA KEV, and EPSS estimates a 0.6% probability of exploitation within 30 days (about the 48th percentile).

What to do: Track the official curl security advisory and upgrade libcurl to the fixed release it specifies (exact fixed version is not given in this data). Audit your applications for use of CURLSSLOPT_NATIVE_CA, especially where transfers to the same hostname mix the option on and off, and as an interim mitigation keep the setting consistent per host or force fresh connections (e.g., CURLOPT_FRESH_CONNECT) to prevent cross-setting reuse.