When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | May 20, 2026 | Jan 8, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libcurl-develUpgrade curl-debuginfoUpgrade curlUpgrade libcurl | May 20, 2026 | May 20, 2026 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Sep 16, 2026 | Sep 14, 2026 |
| Debian | — | Upgrade curl | Jul 12, 2026 | Jul 12, 2026 |
| Freebsd | — | Upgrade curl | Mar 12, 2026 | Mar 11, 2026 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory10 | Jun 28, 2026 | Jun 26, 2026 |
| Notepad Plus Plus | — | Upgrade NotepadPlusPlus to the latest version | Apr 27, 2026 | Jan 8, 2026 |
| Notepadplusplus | — | — | Apr 15, 2026 | Jan 8, 2026 |
| Redhat_linux | — | Upgrade curl-debugsourceUpgrade libcurl-minimalUpgrade libcurl-minimal-debuginfoUpgrade libcurl-develUpgrade curl-debuginfoUpgrade libcurlNo solution existsUpgrade libcurl-debuginfoUpgrade curl | Jul 17, 2026 | Jan 7, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.4.14Upgrade Splunk Enterprise to version 10.2.6Upgrade Splunk Enterprise to version 10.4.2Upgrade Splunk Enterprise to version 10.0.9 | Aug 20, 2026 | Jan 8, 2026 |
| Ubuntu | — | Upgrade libcurl4-nss-devUpgrade libcurl4Upgrade libcurl4-openssl-devUpgrade libcurl4-gnutls-devUpgrade libcurl4t64Upgrade curlUpgrade libcurl3-gnutlsUpgrade libcurl3t64-gnutlsUpgrade libcurl3-nss | Feb 26, 2026 | Feb 25, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 8, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub