Eunsoo Kim

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** A flaw in the SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker performing a Man-in-the-Middle (MITM) attack—where the attacker secretly relays and possibly alters the communication between two parties—can inject a premature or shortcut response to bypass complete peer validation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl (affected versions not specified) **Description** An issue exists where libcurl may send request data on a new connection before enforcing certificate verification failure. This occurs when a user first connects to a legitimate HTTP/3 server and subsequently connects to an attacker's impostor machine lacking a valid certificate. The leak of sensitive information can happen if a cached SSL session is used (where `CURLOPT SSL SESSIONID CACHE` is enabled) and early data is active (where the `CURLSSLOPT EARLYDATA` bit is set in `CURLOPT SSL OPTIONS`). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Disable the `CURLOPT SSL SESSIONID CACHE` option. Disable the `CURLSSLOPT EARLYDATA` bit within `CURLOPT SSL OPTIONS`.