CVE-2026-107929

Full vulnerability record from the local CVENow database.

Description

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address

Severity

Not scored

CVSS score

Not available

Vulnerability status

Awaiting Analysis

Source identifier

2499f714-1537-4658-8207-48ae4bb9eae9

Published

2026-10-20 21:17:15.593000

Last modified

2026-10-22 17:21:57.293000

View original CVE JSON

{
  "id": "CVE-2026-107929",
  "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
  "published": "2026-10-20T21:17:15.593",
  "lastModified": "2026-10-22T17:21:57.293",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address"
    }
  ],
  "affected": [
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "affectedData": [
        {
          "vendor": "curl",
          "product": "curl",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "8.22.0",
              "lessThanOrEqual": "8.22.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.21.0",
              "lessThanOrEqual": "8.21.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.20.0",
              "lessThanOrEqual": "8.20.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.19.0",
              "lessThanOrEqual": "8.19.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.18.0",
              "lessThanOrEqual": "8.18.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.17.0",
              "lessThanOrEqual": "8.17.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.16.0",
              "lessThanOrEqual": "8.16.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.15.0",
              "lessThanOrEqual": "8.15.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.14.1",
              "lessThanOrEqual": "8.14.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.14.0",
              "lessThanOrEqual": "8.14.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.13.0",
              "lessThanOrEqual": "8.13.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.12.1",
              "lessThanOrEqual": "8.12.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.12.0",
              "lessThanOrEqual": "8.12.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.11.1",
              "lessThanOrEqual": "8.11.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.11.0",
              "lessThanOrEqual": "8.11.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.10.1",
              "lessThanOrEqual": "8.10.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.10.0",
              "lessThanOrEqual": "8.10.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.9.1",
              "lessThanOrEqual": "8.9.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.9.0",
              "lessThanOrEqual": "8.9.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://curl.se/docs/CVE-2026-107929.html",
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9"
    },
    {
      "url": "https://curl.se/docs/CVE-2026-107929.json",
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9"
    },
    {
      "url": "https://hackerone.com/reports/4099618",
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9"
    }
  ]
}