CVE-2026-9545

Name	CVE-2026-9545
Description	In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection before enforcing the certificate verification failure. Potentially leaking sensitive information.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
curl (PTS)	bullseye	7.74.0-1.3+deb11u13	fixed
	bullseye (security)	7.74.0-1.3+deb11u16	fixed
	bookworm	7.88.1-10+deb12u15	fixed
	bookworm (security)	7.88.1-10+deb12u5	fixed
	trixie	8.14.1-2+deb13u4	vulnerable
	forky	8.20.0-5	vulnerable
	sid	8.21.0-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
curl	source	bullseye	(not affected)
curl	source	bookworm	(not affected)
curl	source	(unstable)	8.21.0~rc2-1

Notes

[trixie] - curl <no-dsa> (Minor issue)
[bookworm] - curl <not-affected> (Vulnerable code not present)
[bullseye] - curl <not-affected> (Vulnerable code not present)
https://curl.se/docs/CVE-2026-9545.html
Introduced with: https://github.com/curl/curl/commit/962097b8dd44ed5b9e7984bc1cdffdbdd566857f (curl-8_11_0)
Fixed by: https://github.com/curl/curl/commit/7b9613fa9b1a5e04301a3920eef58e8138dad05e (rc-8_21_0-1, curl-8_21_0)