CVE-2026-8286CWE-295

CVE-2026-8286

High · published July 3, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
22.6
In the wild
Unconfirmed
What it is

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the

connection might reuse an existing live connection even though the TLS

configuration mismatches so it should not.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00309 · 22.6th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2026-07-03T11:16Z
Affected products (1)
ProductVersionsFixed in
haxx/curl≥ 7.30.0, < 8.21.08.21.0
References (4)
https://curl.se/docs/CVE-2026-8286.html · 2499f714-1537-4658-8207-48ae4bb9eae9https://curl.se/docs/CVE-2026-8286.json · 2499f714-1537-4658-8207-48ae4bb9eae9https://hackerone.com/reports/3718195 · 2499f714-1537-4658-8207-48ae4bb9eae9https://hackerone.com/reports/3718195 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 JUL 06:14Z
    wrong STARTTLS connection reuse
    cvelistv5