CVE-2026-86415 | BDVDB-2026-391950 Detail

Description#

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-20Record published in the CVE List.
2. Version 22026-10-30Most recent update recorded in the CVE List.