CVE-2026-11564
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A vulnerability in the libcurl library involves the connection pool, which may retain connections using default native CA trust. When an application switches a handle to custom CA material, old connections might still be reused with the original trust settings.
Risk Assessment
The organization is at risk of man-in-the-middle attacks because the application may continue using connections with inappropriate certificate trust, weakening communication security.
Recommendation
Immediately update the libcurl library to a version that includes the fix for CVE-2026-11564. Also review application configuration for proper CA certificate management.
Original NVD description (English source)
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.