CVE-2026-82208

libcurl, when built against the wolfSSL TLS backend, can silently restore a cached CA trust store after an application has replaced the trust store through a CURLOPT_SSL_CTX_FUNCTION callback, while CA caching is enabled. The flaw is triggered whenever the callback selects a different set of trusted CAs, causing certificate chain validation to run against the cached store instead of the store the application intended. As a result, an attacker can present a server certificate that the application meant to reject (for example, one issued by a CA trusted only by the cached store) and have the TLS connection accepted, undermining the application's intended trust policy (CWE-295, rated 7.5 High). Only applications that use libcurl with the wolfSSL backend and use this callback to swap trust stores are affected; other TLS backends are not impacted. No public proof-of-concept or in-the-wild exploitation is known, and EPSS assigns a roughly 0.3% probability of exploitation within 30 days.

What to do: Check whether your application builds libcurl against wolfSSL and sets CURLOPT_SSL_CTX_FUNCTION to replace trust stores; if so, upgrade to a fixed libcurl release published by the curl project (fixed version not stated in the available data, so check curl.se advisories). As an interim mitigation, avoid swapping trust stores via that callback on the wolfSSL backend, or enforce expected issuer/CA checks at the application layer. There is no evidence of active exploitation, but monitor the curl advisory for patch details.