CVE-2026-8286 - wrong STARTTLS connection reuse

Back Back to CVE browser

HIGH

wrong STARTTLS connection reuse

Published Jul 3, 2026

8.1

HIGH

CVSS 3.1

EPSS 0.31%

Description

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

Affected products

Vendor Curl Product Curl Default
unaffected
- Version
  7.30.0
  Status
  affected
  Constraints
  <8.14.2
- Version
  7.30.0
  Status
  affected
  Constraints
  -
- Version
  7.31.0
  Status
  affected
  Constraints
  -
- Version
  7.32.0
  Status
  affected
  Constraints
  -
- Version
  7.33.0
  Status
  affected
  Constraints
  -
- Version
  7.34.0
  Status
  affected
  Constraints
  -
- Version
  7.35.0
  Status
  affected
  Constraints
  -
- Version
  7.36.0
  Status
  affected
  Constraints
  -
- Version
  7.37.0
  Status
  affected
  Constraints
  -
- Version
  7.37.1
  Status
  affected
  Constraints
  -
- Version
  7.38.0
  Status
  affected
  Constraints
  -
- Version
  7.39.0
  Status
  affected
  Constraints
  -
- Version
  7.40.0
  Status
  affected
  Constraints
  -
- Version
  7.41.0
  Status
  affected
  Constraints
  -
- Version
  7.42.0
  Status
  affected
  Constraints
  -
- Version
  7.42.1
  Status
  affected
  Constraints
  -
- Version
  7.43.0
  Status
  affected
  Constraints
  -
- Version
  7.44.0
  Status
  affected
  Constraints
  -
- Version
  7.45.0
  Status
  affected
  Constraints
  -
- Version
  7.46.0
  Status
  affected
  Constraints
  -
- Version
  7.47.0
  Status
  affected
  Constraints
  -
- Version
  7.47.1
  Status
  affected
  Constraints
  -
- Version
  7.48.0
  Status
  affected
  Constraints
  -
- Version
  7.49.0
  Status
  affected
  Constraints
  -
- Version
  7.49.1
  Status
  affected
  Constraints
  -
- Version
  7.50.0
  Status
  affected
  Constraints
  -
- Version
  7.50.1
  Status
  affected
  Constraints
  -
- Version
  7.50.2
  Status
  affected
  Constraints
  -
- Version
  7.50.3
  Status
  affected
  Constraints
  -
- Version
  7.51.0
  Status
  affected
  Constraints
  -
- Version
  7.52.0
  Status
  affected
  Constraints
  -
- Version
  7.52.1
  Status
  affected
  Constraints
  -
- Version
  7.53.0
  Status
  affected
  Constraints
  -
- Version
  7.53.1
  Status
  affected
  Constraints
  -
- Version
  7.54.0
  Status
  affected
  Constraints
  -
- Version
  7.54.1
  Status
  affected
  Constraints
  -
- Version
  7.55.0
  Status
  affected
  Constraints
  -
- Version
  7.55.1
  Status
  affected
  Constraints
  -
- Version
  7.56.0
  Status
  affected
  Constraints
  -
- Version
  7.56.1
  Status
  affected
  Constraints
  -
- Version
  7.57.0
  Status
  affected
  Constraints
  -
- Version
  7.58.0
  Status
  affected
  Constraints
  -
- Version
  7.59.0
  Status
  affected
  Constraints
  -
- Version
  7.60.0
  Status
  affected
  Constraints
  -
- Version
  7.61.0
  Status
  affected
  Constraints
  -
- Version
  7.61.1
  Status
  affected
  Constraints
  -
- Version
  7.62.0
  Status
  affected
  Constraints
  -
- Version
  7.63.0
  Status
  affected
  Constraints
  -
- Version
  7.64.0
  Status
  affected
  Constraints
  -
- Version
  7.64.1
  Status
  affected
  Constraints
  -
- Version
  7.65.0
  Status
  affected
  Constraints
  -
- Version
  7.65.1
  Status
  affected
  Constraints
  -
- Version
  7.65.2
  Status
  affected
  Constraints
  -
- Version
  7.65.3
  Status
  affected
  Constraints
  -
- Version
  7.66.0
  Status
  affected
  Constraints
  -
- Version
  7.67.0
  Status
  affected
  Constraints
  -
- Version
  7.68.0
  Status
  affected
  Constraints
  -
- Version
  7.69.0
  Status
  affected
  Constraints
  -
- Version
  7.69.1
  Status
  affected
  Constraints
  -
- Version
  7.70.0
  Status
  affected
  Constraints
  -
- Version
  7.71.0
  Status
  affected
  Constraints
  -
- Version
  7.71.1
  Status
  affected
  Constraints
  -
- Version
  7.72.0
  Status
  affected
  Constraints
  -
- Version
  7.73.0
  Status
  affected
  Constraints
  -
- Version
  7.74.0
  Status
  affected
  Constraints
  -
- Version
  7.75.0
  Status
  affected
  Constraints
  -
- Version
  7.76.0
  Status
  affected
  Constraints
  -
- Version
  7.76.1
  Status
  affected
  Constraints
  -
- Version
  7.77.0
  Status
  affected
  Constraints
  -
- Version
  7.78.0
  Status
  affected
  Constraints
  -
- Version
  7.79.0
  Status
  affected
  Constraints
  -
- Version
  7.79.1
  Status
  affected
  Constraints
  -
- Version
  7.80.0
  Status
  affected
  Constraints
  -
- Version
  7.81.0
  Status
  affected
  Constraints
  -
- Version
  7.82.0
  Status
  affected
  Constraints
  -
- Version
  7.83.0
  Status
  affected
  Constraints
  -
- Version
  7.83.1
  Status
  affected
  Constraints
  -
- Version
  7.84.0
  Status
  affected
  Constraints
  -
- Version
  7.85.0
  Status
  affected
  Constraints
  -
- Version
  7.86.0
  Status
  affected
  Constraints
  -
- Version
  7.87.0
  Status
  affected
  Constraints
  -
- Version
  7.88.0
  Status
  affected
  Constraints
  -
- Version
  7.88.1
  Status
  affected
  Constraints
  -
- Version
  8.0.0
  Status
  affected
  Constraints
  -
- Version
  8.0.1
  Status
  affected
  Constraints
  -
- Version
  8.1.0
  Status
  affected
  Constraints
  -
- Version
  8.1.1
  Status
  affected
  Constraints
  -
- Version
  8.1.2
  Status
  affected
  Constraints
  -
- Version
  8.10.0
  Status
  affected
  Constraints
  -
- Version
  8.10.1
  Status
  affected
  Constraints
  -
- Version
  8.11.0
  Status
  affected
  Constraints
  -
- Version
  8.11.1
  Status
  affected
  Constraints
  -
- Version
  8.12.0
  Status
  affected
  Constraints
  -
- Version
  8.12.1
  Status
  affected
  Constraints
  -
- Version
  8.13.0
  Status
  affected
  Constraints
  -
- Version
  8.14.0
  Status
  affected
  Constraints
  -
- Version
  8.14.1
  Status
  affected
  Constraints
  -
- Version
  8.15.0
  Status
  affected
  Constraints
  <8.16.1
- Version
  8.15.0
  Status
  affected
  Constraints
  -
- Version
  8.16.0
  Status
  affected
  Constraints
  -
- Version
  8.17.0
  Status
  affected
  Constraints
  <8.20.1
- Version
  8.17.0
  Status
  affected
  Constraints
  -
- Version
  8.18.0
  Status
  affected
  Constraints
  -
- Version
  8.19.0
  Status
  affected
  Constraints
  -
- Version
  8.2.0
  Status
  affected
  Constraints
  -
- Version
  8.2.1
  Status
  affected
  Constraints
  -
- Version
  8.20.0
  Status
  affected
  Constraints
  -
- Version
  8.3.0
  Status
  affected
  Constraints
  -
- Version
  8.4.0
  Status
  affected
  Constraints
  -
- Version
  8.5.0
  Status
  affected
  Constraints
  -
- Version
  8.6.0
  Status
  affected
  Constraints
  -
- Version
  8.7.0
  Status
  affected
  Constraints
  -
- Version
  8.7.1
  Status
  affected
  Constraints
  -
- Version
  8.8.0
  Status
  affected
  Constraints
  -
- Version
  8.9.0
  Status
  affected
  Constraints
  -
- Version
  8.9.1
  Status
  affected
  Constraints
  -
Vendor Curl Product Curl Default
unaffected
- Version
  
  Status
  affected
  Constraints

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Curl

unaffected

Version	Status	Constraints
7.30.0	affected	<8.14.2
7.30.0	affected	-
7.31.0	affected	-
7.32.0	affected	-
7.33.0	affected	-
7.34.0	affected	-
7.35.0	affected	-
7.36.0	affected	-
7.37.0	affected	-
7.37.1	affected	-
7.38.0	affected	-
7.39.0	affected	-
7.40.0	affected	-
7.41.0	affected	-
7.42.0	affected	-
7.42.1	affected	-
7.43.0	affected	-
7.44.0	affected	-
7.45.0	affected	-
7.46.0	affected	-
7.47.0	affected	-
7.47.1	affected	-
7.48.0	affected	-
7.49.0	affected	-
7.49.1	affected	-
7.50.0	affected	-
7.50.1	affected	-
7.50.2	affected	-
7.50.3	affected	-
7.51.0	affected	-
7.52.0	affected	-
7.52.1	affected	-
7.53.0	affected	-
7.53.1	affected	-
7.54.0	affected	-
7.54.1	affected	-
7.55.0	affected	-
7.55.1	affected	-
7.56.0	affected	-
7.56.1	affected	-
7.57.0	affected	-
7.58.0	affected	-
7.59.0	affected	-
7.60.0	affected	-
7.61.0	affected	-
7.61.1	affected	-
7.62.0	affected	-
7.63.0	affected	-
7.64.0	affected	-
7.64.1	affected	-
7.65.0	affected	-
7.65.1	affected	-
7.65.2	affected	-
7.65.3	affected	-
7.66.0	affected	-
7.67.0	affected	-
7.68.0	affected	-
7.69.0	affected	-
7.69.1	affected	-
7.70.0	affected	-
7.71.0	affected	-
7.71.1	affected	-
7.72.0	affected	-
7.73.0	affected	-
7.74.0	affected	-
7.75.0	affected	-
7.76.0	affected	-
7.76.1	affected	-
7.77.0	affected	-
7.78.0	affected	-
7.79.0	affected	-
7.79.1	affected	-
7.80.0	affected	-
7.81.0	affected	-
7.82.0	affected	-
7.83.0	affected	-
7.83.1	affected	-
7.84.0	affected	-
7.85.0	affected	-
7.86.0	affected	-
7.87.0	affected	-
7.88.0	affected	-
7.88.1	affected	-
8.0.0	affected	-
8.0.1	affected	-
8.1.0	affected	-
8.1.1	affected	-
8.1.2	affected	-
8.10.0	affected	-
8.10.1	affected	-
8.11.0	affected	-
8.11.1	affected	-
8.12.0	affected	-
8.12.1	affected	-
8.13.0	affected	-
8.14.0	affected	-
8.14.1	affected	-
8.15.0	affected	<8.16.1
8.15.0	affected	-
8.16.0	affected	-
8.17.0	affected	<8.20.1
8.17.0	affected	-
8.18.0	affected	-
8.19.0	affected	-
8.2.0	affected	-
8.2.1	affected	-
8.20.0	affected	-
8.3.0	affected	-
8.4.0	affected	-
8.5.0	affected	-
8.6.0	affected	-
8.7.0	affected	-
8.7.1	affected	-
8.8.0	affected	-
8.9.0	affected	-
8.9.1	affected	-

Curl

unaffected

Version	Status	Constraints
	affected

Cert Manager support for Red Hat OpenShift release 1.19

cert-manager/cert-manager-istio-csr-rhel9:1788348594

Fixed · RHSA-2026:63140
Cert Manager support for Red Hat OpenShift release 1.19

cert-manager/cert-manager-operator-rhel9:1788348522

Fixed · RHSA-2026:63135
Cert Manager support for Red Hat OpenShift release 1.19

cert-manager/jetstack-cert-manager-acmesolver-rhel9:1788348571

Fixed · RHSA-2026:63138
Cert Manager support for Red Hat OpenShift release 1.19

cert-manager/jetstack-cert-manager-rhel9:1788348571

Fixed · RHSA-2026:63138
Red Hat Discovery 2

discovery/discovery-server-rhel9:1788205779

Fixed · RHSA-2026:61783
Red Hat Discovery 2

discovery/discovery-ui-rhel9:1788206196

Fixed · RHSA-2026:61783
Red Hat Enterprise Linux 10

curl-0:8.12.1-4.el10_2.3

Fixed · RHSA-2026:55450
Red Hat Enterprise Linux 8

curl-0:7.61.1-34.el8_10.13

Fixed · RHSA-2026:57462
Red Hat Enterprise Linux 9

curl-0:7.76.1-40.el9_8.5

Fixed · RHSA-2026:55439
Red Hat Enterprise Linux 9

curl-0:7.76.1-40.el9_8.5

Fixed · RHSA-2026:55439
Red Hat Hardened Images

curl-main-8.21.0-0.1.hum1

Fixed · RHSA-2026:29017
Red Hat Hardened Images

rust-main-1.96.1-1.hum1

Fixed · RHSA-2026:34975
Red Hat OpenShift Container Platform 4.22

rhcos-4.22.9.8.202608251819-0

Fixed · RHSA-2026:60440
Red Hat OpenShift Container Platform 4.22

rhcos-4.22.9.8.202609081748-0

Fixed · RHSA-2026:66357
Red Hat OpenShift Dev Spaces 3.30

devspaces/code-rhel9:1787762793

Fixed · RHSA-2026:62260
Red Hat Update Infrastructure 5

rhui5/cds-kubernetes-rhel9:1788880445

Fixed · RHSA-2026:66018
Red Hat Update Infrastructure 5

rhui5/cds-kubernetes-tp-rhel9:1787241211

Fixed · RHSA-2026:58981
Red Hat Update Infrastructure 5

rhui5/cds-rhel9:1788880464

Fixed · RHSA-2026:66018
Red Hat Update Infrastructure 5

rhui5/haproxy-rhel9:1788880456

Fixed · RHSA-2026:66018
Red Hat Update Infrastructure 5

rhui5/installer-rhel9:1788765051

Fixed · RHSA-2026:66018
Red Hat Update Infrastructure 5

rhui5/installer-tp-rhel9:1787135742

Fixed · RHSA-2026:58981
Red Hat Update Infrastructure 5

rhui5/rhua-rhel9:1788880581

Fixed · RHSA-2026:66018
Red Hat Update Infrastructure 5

rhui5/rhua-tp-rhel9:1787241260

Fixed · RHSA-2026:58981
Red Hat Enterprise Linux 6

curl

Will not fix
Red Hat Enterprise Linux 7

curl

Affected
Red Hat OpenShift Container Platform 4

openshift/ose-rhel-coreos-8

Affected
Red Hat Trusted Profile Analyzer

rhtpa/rhtpa-trustification-service-rhel9

Not affected

Product	Package	State	Advisory
Cert Manager support for Red Hat OpenShift release 1.19	cert-manager/cert-manager-istio-csr-rhel9:1788348594	Fixed	RHSA-2026:63140
Cert Manager support for Red Hat OpenShift release 1.19	cert-manager/cert-manager-operator-rhel9:1788348522	Fixed	RHSA-2026:63135
Cert Manager support for Red Hat OpenShift release 1.19	cert-manager/jetstack-cert-manager-acmesolver-rhel9:1788348571	Fixed	RHSA-2026:63138
Cert Manager support for Red Hat OpenShift release 1.19	cert-manager/jetstack-cert-manager-rhel9:1788348571	Fixed	RHSA-2026:63138
Red Hat Discovery 2	discovery/discovery-server-rhel9:1788205779	Fixed	RHSA-2026:61783
Red Hat Discovery 2	discovery/discovery-ui-rhel9:1788206196	Fixed	RHSA-2026:61783
Red Hat Enterprise Linux 10	curl-0:8.12.1-4.el10_2.3	Fixed	RHSA-2026:55450
Red Hat Enterprise Linux 8	curl-0:7.61.1-34.el8_10.13	Fixed	RHSA-2026:57462
Red Hat Enterprise Linux 9	curl-0:7.76.1-40.el9_8.5	Fixed	RHSA-2026:55439
Red Hat Enterprise Linux 9	curl-0:7.76.1-40.el9_8.5	Fixed	RHSA-2026:55439
Red Hat Hardened Images	curl-main-8.21.0-0.1.hum1	Fixed	RHSA-2026:29017
Red Hat Hardened Images	rust-main-1.96.1-1.hum1	Fixed	RHSA-2026:34975
Red Hat OpenShift Container Platform 4.22	rhcos-4.22.9.8.202608251819-0	Fixed	RHSA-2026:60440
Red Hat OpenShift Container Platform 4.22	rhcos-4.22.9.8.202609081748-0	Fixed	RHSA-2026:66357
Red Hat OpenShift Dev Spaces 3.30	devspaces/code-rhel9:1787762793	Fixed	RHSA-2026:62260
Red Hat Update Infrastructure 5	rhui5/cds-kubernetes-rhel9:1788880445	Fixed	RHSA-2026:66018
Red Hat Update Infrastructure 5	rhui5/cds-kubernetes-tp-rhel9:1787241211	Fixed	RHSA-2026:58981
Red Hat Update Infrastructure 5	rhui5/cds-rhel9:1788880464	Fixed	RHSA-2026:66018
Red Hat Update Infrastructure 5	rhui5/haproxy-rhel9:1788880456	Fixed	RHSA-2026:66018
Red Hat Update Infrastructure 5	rhui5/installer-rhel9:1788765051	Fixed	RHSA-2026:66018
Red Hat Update Infrastructure 5	rhui5/installer-tp-rhel9:1787135742	Fixed	RHSA-2026:58981
Red Hat Update Infrastructure 5	rhui5/rhua-rhel9:1788880581	Fixed	RHSA-2026:66018
Red Hat Update Infrastructure 5	rhui5/rhua-tp-rhel9:1787241260	Fixed	RHSA-2026:58981
Red Hat Enterprise Linux 6	curl	Will not fix	n/a
Red Hat Enterprise Linux 7	curl	Affected	n/a
Red Hat OpenShift Container Platform 4	openshift/ose-rhel-coreos-8	Affected	n/a
Red Hat Trusted Profile Analyzer	rhtpa/rhtpa-trustification-service-rhel9	Not affected	n/a

Remediation

Red Hat statement

This is an Important flaw as `curl` may establish an insecure connection when attempting to upgrade a transfer with STARTTLS, potentially reusing an existing connection with mismatched TLS configurations. This could lead to unexpected data exposure or compromise, particularly in environments where `curl` is used for sensitive data transfers and relies on STARTTLS for security.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-295

Improper Certificate Validation

References (8)

https://access.redhat.com/security/cve/CVE-2026-8286
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2496763
Issue Tracking
https://curl.se/docs/CVE-2026-8286.html
PatchVendor Advisory
https://curl.se/docs/CVE-2026-8286.json
Vendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41503
Advisory
https://hackerone.com/reports/3718195
exploitIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-8286
https://www.cve.org/CVERecord?id=CVE-2026-8286

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-8286		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2496763		Issue Tracking
https://curl.se/docs/CVE-2026-8286.html		PatchVendor Advisory
https://curl.se/docs/CVE-2026-8286.json		Vendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41503		Advisory
https://hackerone.com/reports/3718195		exploitIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-8286
https://www.cve.org/CVERecord?id=CVE-2026-8286