UNKNOWN NVD
CVE-2026-86415
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be
libcurl's connection cache match function never considers the automatic client
certificate option, so a cached, already authenticated Schannel connection can
be handed to a transfer that got redirected to a different origin, even though
the code explicitly switched off the auto client cert option for that transfer
to prevent exactly this.
References
- https://curl.se/docs/CVE-2026-86415.html
- https://curl.se/docs/CVE-2026-86415.json
- https://hackerone.com/reports/3993870
This unknown severity vulnerability was published on 2026-10-20 via NVD.
vulnfeed aggregates 18176 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.