CVE-2026-8286

Опубликовано: 03 июл. 2026

Источник: nvd

CVSS3: 8.1

EPSS Низкий

Описание

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

Ссылки

https://curl.se/docs/CVE-2026-8286.html
Patch
Vendor Advisory
https://curl.se/docs/CVE-2026-8286.json
Vendor Advisory
https://hackerone.com/reports/3718195
Exploit
Issue Tracking
Third Party Advisory
https://hackerone.com/reports/3718195
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Версия от 7.30.0 (включая) до 8.21.0 (исключая)

EPSS

Процентиль: 24%

0.00309

Низкий

8.1 High

CVSS3

Дефекты

CWE-295

Связанные уязвимости

CVE-2026-8286

CVSS3: 8.1

ubuntu

2 месяца назад

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

CVE-2026-8286

CVSS3: 8.1

redhat

2 месяца назад

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

CVE-2026-8286

CVSS3: 8.1

msrc

2 месяца назад

wrong STARTTLS connection reuse

CVE-2026-8286

CVSS3: 8.1

debian

2 месяца назад

A vulnerability exists where a new transfer that uses STARTTLS to upgr ...

RLSA-2026:57462

rocky

25 дней назад

Important: curl security, bug fix, and enhancement update

EPSS

Процентиль: 24%

0.00309

Низкий

8.1 High

CVSS3

Дефекты

CWE-295