{"id":"CVE-2026-107929","aliases":[],"cve":{"records":[{"id":"CVE-2026-107929","source":"curl","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-09T07:51:38.463Z","published":"2026-10-20T20:29:28.177Z","modified":"2026-10-30T16:31:15.917Z"}],"publishers":[{"name":"curl","role":"CNA","organizationId":"2499f714-1537-4658-8207-48ae4bb9eae9","modified":"2026-10-20T20:29:28.177Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T16:31:15.917Z"}],"references":[{"url":"https://curl.se/docs/CVE-2026-107929.json","tags":[],"source":"curl"},{"url":"https://curl.se/docs/CVE-2026-107929.html","tags":[],"source":"curl"},{"url":"https://hackerone.com/reports/4099618","tags":[],"source":"curl"},{"url":"https://hackerone.com/reports/4099618","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-488","description":"CWE-488 Exposure of Data Element to Wrong Session","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T16:30:50.273989Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"local interface connection reuse mixup","titleSource":"curl","descriptionSource":"curl","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address","score":8.1,"severity":"high","published":"2026-10-20T20:29:28.177Z","modified":"2026-10-30T16:31:15.917Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"curl","name":"curl","platforms":[],"versions":[{"version":"8.22.0","status":"affected","lessThanOrEqual":"8.22.0","versionType":"semver"},{"version":"8.21.0","status":"affected","lessThanOrEqual":"8.21.0","versionType":"semver"},{"version":"8.20.0","status":"affected","lessThanOrEqual":"8.20.0","versionType":"semver"},{"version":"8.19.0","status":"affected","lessThanOrEqual":"8.19.0","versionType":"semver"},{"version":"8.18.0","status":"affected","lessThanOrEqual":"8.18.0","versionType":"semver"},{"version":"8.17.0","status":"affected","lessThanOrEqual":"8.17.0","versionType":"semver"},{"version":"8.16.0","status":"affected","lessThanOrEqual":"8.16.0","versionType":"semver"},{"version":"8.15.0","status":"affected","lessThanOrEqual":"8.15.0","versionType":"semver"},{"version":"8.14.1","status":"affected","lessThanOrEqual":"8.14.1","versionType":"semver"},{"version":"8.14.0","status":"affected","lessThanOrEqual":"8.14.0","versionType":"semver"},{"version":"8.13.0","status":"affected","lessThanOrEqual":"8.13.0","versionType":"semver"},{"version":"8.12.1","status":"affected","lessThanOrEqual":"8.12.1","versionType":"semver"},{"version":"8.12.0","status":"affected","lessThanOrEqual":"8.12.0","versionType":"semver"},{"version":"8.11.1","status":"affected","lessThanOrEqual":"8.11.1","versionType":"semver"},{"version":"8.11.0","status":"affected","lessThanOrEqual":"8.11.0","versionType":"semver"},{"version":"8.10.1","status":"affected","lessThanOrEqual":"8.10.1","versionType":"semver"},{"version":"8.10.0","status":"affected","lessThanOrEqual":"8.10.0","versionType":"semver"},{"version":"8.9.1","status":"affected","lessThanOrEqual":"8.9.1","versionType":"semver"},{"version":"8.9.0","status":"affected","lessThanOrEqual":"8.9.0","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"curl","url":"https://www.cve.org/CVERecord?id=CVE-2026-107929"}],"remediation":[],"references":["https://curl.se/docs/CVE-2026-107929.json","https://curl.se/docs/CVE-2026-107929.html","https://hackerone.com/reports/4099618"],"sources":[{"name":"CVE","id":"CVE-2026-107929","modified":"2026-10-30T16:31:15.917Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-107929"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1}],"sourceAffected":[],"observedAt":"2026-10-30T17:32:38.917Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:45:32.518Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T18:00:33.689Z","attemptedAt":"2026-10-30T18:00:33.689Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T18:00:33.604Z","attemptedAt":"2026-10-30T18:00:33.604Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T18:00:34.639Z","attemptedAt":"2026-10-30T18:00:34.639Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T18:00:34.613Z","attemptedAt":"2026-10-30T18:00:34.613Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-9644-8jhv-gxgm","url":"https://github.com/advisories/GHSA-9644-8jhv-gxgm","modified":"2026-10-20T21:31:07Z","checkedAt":"2026-10-30T18:00:33.604Z"},{"source":"NVD","id":"CVE-2026-107929","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","modified":"2026-10-30T17:17:12.723","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-30T18:00:33.689Z"},{"source":"FIRST EPSS","id":"CVE-2026-107929","url":"https://www.first.org/epss/","probability":0.00239,"percentile":0.15095,"date":"2026-10-30","checkedAt":"2026-10-30T18:00:34.613Z"},{"source":"ENISA EUVD","id":"EUVD-2026-105359","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105359","modified":"Oct 30, 2026, 4:31:15 PM","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-30T18:00:34.639Z"}],"aiSummary":null}