curl: Connection reuse mixup with local interface binding

Summary

curl and libcurl do not include the local interface binding (CURLOPT_INTERFACE or --interface with the prefixes if!, host! or ifhost!) in the connection reuse key. A later transfer that requests a different source can therefore silently reuse an existing connection and send traffic from the source address of the earlier transfer. The issue affects only applications that use these options for per-transfer source binding, such as multi-homed, VPN or policy-routed hosts, or setups that rely on source IP for allow-listing. The vendor rates the issue as Low and classifies it as CWE-488, while the record in this tracker shows CVSS 8.1 (HIGH); the priority should be checked against the NVD entry.

Affected

• curl 8.9.0 up to and including 8.22.0 (vendor data)
• Not affected: curl versions before 8.9.0 and 8.23.0 or later
• Not affected: 8.20.2 or later in the 8.20.X branch, 8.16.2 or later in the 8.16.X branch, 8.14.3 or later in the 8.14.X branch
• Affected: the curl command line tool and libcurl-based applications
• Distributions differ: Debian bookworm not affected, Debian trixie still listed as vulnerable, Debian sid fixed in 8.23.0-1; Ubuntu and Red Hat entries vary, so check the vendor advisory of the distribution

Fixed in

• curl 8.23.0 (released October 14, 2026)
• Upstream patch: commit d37d79df1e01066417aff0a9e
• Debian sid: 8.23.0-1
• Ubuntu 26.04 LTS: 8.18.0-1ubuntu2.8 (per the Ubuntu notice; not confirmed in this review)
• Ubuntu 26.10: 8.20.0-2ubuntu11.1 (per the Ubuntu notice)
• Red Hat hardened images: 8.23.0-0.1.hum1 (no standard RHEL errata found)

Workaround

• Avoid CURLOPT_INTERFACE and the --interface option, as recommended by the vendor
• Review applications that bind transfers to a specific source address and remove this binding where it is not required

Exploitation

• The CISA SSVC assessment lists exploitation as 'poc' and automatable as 'no'
• No evidence of exploitation in the wild was found
• No public proof of concept for this CVE was found in the checked sources
• Attacker prerequisites are not stated in the advisory and are unknown

Our recommendation

• Identify systems, scripts and products that embed libcurl or call curl with --interface, and record their versions
• Update to curl 8.23.0 or a fixed distribution package, or apply the upstream patch
• Where an update is not possible, remove or avoid the interface binding options
• Check the priority against the NVD entry and the vendor's Low rating before communicating it internally

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• curl security advisory CVE-2026-107929 curl.se
• curl CVE metadata (JSON) curl.se
• Original report (HackerOne) hackerone.com
• curl changes curl.se
• Debian security tracker security-tracker.debian.org
• Ubuntu security notice ubuntu.com
• Linux Security advisory for Ubuntu linuxsecurity.com
• Red Hat RHSA-2026:82895 (via Vulners) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:36.