CVE-2026-8286

Опубликовано: 03 июл. 2026

Источник: nvd

CVSS3: 8.1

EPSS Низкий

Описание

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

Ссылки

https://curl.se/docs/CVE-2026-8286.html
Patch
Vendor Advisory
https://curl.se/docs/CVE-2026-8286.json
Vendor Advisory
https://hackerone.com/reports/3718195
Exploit
Issue Tracking
Third Party Advisory
https://hackerone.com/reports/3718195
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Версия от 7.30.0 (включая) до 8.21.0 (исключая)

EPSS

Процентиль: 23%

0.00309

Низкий

8.1 High

CVSS3

Дефекты

CWE-295

Связанные уязвимости

CVE-2026-8286

CVSS3: 8.1

ubuntu

28 дней назад

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

CVE-2026-8286

CVSS3: 8.1

redhat

28 дней назад

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

CVE-2026-8286

CVSS3: 8.1

msrc

19 дней назад

wrong STARTTLS connection reuse

CVE-2026-8286

CVSS3: 8.1

debian

28 дней назад

A vulnerability exists where a new transfer that uses STARTTLS to upgr ...

GHSA-32xh-3x3c-6g6h

CVSS3: 8.1

github

28 дней назад

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

EPSS

Процентиль: 23%

0.00309

Низкий

8.1 High

CVSS3

Дефекты

CWE-295