CVE-2026-9545 - Vulnerability Details - OpenCVE

In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

References

Link	Providers
https://curl.se/docs/CVE-2026-9545.html
https://curl.se/docs/CVE-2026-9545.json
https://hackerone.com/reports/3752888

History

Fri, 03 Jul 2026 06:45:00 +0000

Type	Values Removed	Values Added
Description		In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection before enforcing the certificate verification failure. Potentially leaking sensitive information.
Title		exposing HTTP/3 early data
References		https://curl.se/docs/CVE-2026-9545.html https://curl.se/docs/CVE-2026-9545.json https://hackerone.com/reports/3752888

MITRE

Status: PUBLISHED

Assigner: curl

Published: 2026-07-03T06:17:55.931Z

Updated: 2026-07-03T06:17:55.931Z

Reserved: 2026-05-26T06:45:08.680Z

Link: CVE-2026-9545

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9545", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "state": "PUBLISHED", "assignerShortName": "curl", "dateReserved": "2026-05-26T06:45:08.680Z", "datePublished": "2026-07-03T06:17:55.931Z", "dateUpdated": "2026-07-03T06:17:55.931Z"}, "containers": {"cna": {"title": "exposing HTTP/3 early data", "descriptions": [{"lang": "en", "value": "In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation."}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-07-03T06:17:55.931Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"version": "8.20.0", "status": "affected", "lessThanOrEqual": "8.20.0", "versionType": "semver"}, {"version": "8.19.0", "status": "affected", "lessThanOrEqual": "8.19.0", "versionType": "semver"}, {"version": "8.18.0", "status": "affected", "lessThanOrEqual": "8.18.0", "versionType": "semver"}, {"version": "8.17.0", "status": "affected", "lessThanOrEqual": "8.17.0", "versionType": "semver"}, {"version": "8.16.0", "status": "affected", "lessThanOrEqual": "8.16.0", "versionType": "semver"}, {"version": "8.15.0", "status": "affected", "lessThanOrEqual": "8.15.0", "versionType": "semver"}, {"version": "8.14.1", "status": "affected", "lessThanOrEqual": "8.14.1", "versionType": "semver"}, {"version": "8.14.0", "status": "affected", "lessThanOrEqual": "8.14.0", "versionType": "semver"}, {"version": "8.13.0", "status": "affected", "lessThanOrEqual": "8.13.0", "versionType": "semver"}, {"version": "8.12.1", "status": "affected", "lessThanOrEqual": "8.12.1", "versionType": "semver"}, {"version": "8.12.0", "status": "affected", "lessThanOrEqual": "8.12.0", "versionType": "semver"}, {"version": "8.11.1", "status": "affected", "lessThanOrEqual": "8.11.1", "versionType": "semver"}, {"version": "8.11.0", "status": "affected", "lessThanOrEqual": "8.11.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-9545.json", "name": "json"}, {"url": "https://curl.se/docs/CVE-2026-9545.html", "name": "www"}, {"url": "https://hackerone.com/reports/3752888", "name": "issue"}], "credits": [{"lang": "en", "value": "Eunsoo Kim (Autonomous Code Security team at Microsoft)", "type": "finder"}, {"lang": "en", "value": "Stefan Eissing", "type": "remediation developer"}]}}}