CVE-2026-11564 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-11564 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-11564 is a TLS certificate validation bypass vulnerability in Haxx libcurl, affecting the connection pool reuse logic that allows an easy handle configured with default native CA trust to inherit or misapply certificate verification settings from a previously established connection.

Technical Detail

The flaw exists in how libcurl manages its connection pool: when an easy handle initially configured to use the system's native CA trust store reuses a pooled connection, the certificate authority validation context from the prior connection may be incorrectly applied to the new transfer. An attacker positioned to intercept or influence TLS connections, such as via a man-in-the-middle position on the network, could exploit this to present a fraudulent certificate that passes validation it should fail, effectively achieving a TLS authentication bypass. The practical impact is that encrypted communications believed to be verified against trusted CAs may be silently accepted without proper chain validation, exposing sensitive data in transit to interception or manipulation.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is assessed as none, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. No public proof-of-concept code has been identified as of July 10, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability in available intelligence sources.

What To Do

Apply the vendor-supplied patch from Haxx for the affected version of libcurl as soon as it is available, prioritizing systems where libcurl is used for sensitive authenticated communications or in environments with untrusted network paths. As an interim measure, applications using libcurl should be reviewed to ensure they explicitly set certificate verification options per handle rather than relying on inherited or pooled connection state. Organizations should audit any application that uses libcurl's easy handle interface with mixed CA trust configurations and consider disabling connection reuse in high-sensitivity contexts until patching is complete. Monitor network traffic for unexpected TLS certificate changes on connections handled by libcurl-dependent applications as a detection signal.