CVE-2026-9545

Name of the Vulnerable Software and Affected Versions libcurl (affected versions not specified)

Description An issue exists where libcurl may send request data on a new connection before enforcing certificate verification failure. This occurs when a user first connects to a legitimate HTTP/3 server and subsequently connects to an attacker's impostor machine lacking a valid certificate. The leak of sensitive information can happen if a cached SSL session is used (where CURLOPT SSL SESSIONID CACHE is enabled) and early data is active (where the CURLSSLOPT EARLYDATA bit is set in CURLOPT SSL OPTIONS).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Disable the CURLOPT SSL SESSIONID CACHE option. Disable the CURLSSLOPT EARLYDATA bit within CURLOPT SSL OPTIONS.