PT-2026-51754 · Git · Curl

Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-9545

OSV

In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate.

When libcurl returns to the hostname the second time with a cached SSL session (CURLOPT SSL SESSIONID CACHE is not disabled) and early data enabled (the CURLSSLOPT EARLYDATA bit is set in CURLOPT SSL OPTIONS), libcurl might send off the second request's bytes on that new connection before enforcing the certificate verification failure. Potentially leaking sensitive information.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-9545

Produtos afetados

Curl

Referências · 2

• https://osv.dev/vulnerability/CURL-CVE-2026-9545 · Aviso do Fabricante
• https://hackerone.com/reports/3752888 · Nota