CVE-2026-8286

CVSS 3.1: 8.1 high
EPSS: <1%p24
Published: Jul 3, 2026 · Jul 3, 2026
Modified: Sep 15, 2026

Analyze CVE-2026-8286 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

Vendors: haxx

Products: curl

Weakness: CWE-295

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news

1 story

USN-8487-2: curl regression

Ubuntu patches an incomplete curl fix for CVE-2026-8927 and related connection-reuse flaws.

Ubuntu Security NoticesSep 28, 20:29 UTC · Sep 28, 2026AdvisoryCVE-2026-8927 CVE-2026-82861 · 1 read