curl vulnerability

What happened

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

Affected versions

curl: 8.17.0 through before 8.20.1 (semver); eefd03c572996e5de4dec4fe295ad6f103e0eefc through before d69bfad3fa3daf5e72331f6870667607828d5891 (git); 8.20.0; 8.19.0; 8.18.0; 8.17.0 Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.