CVE-2026-82208EPSS p32.7%
CVE-2026-82208CVE-2026-82208
haxx / curl
Description
With the wolfSSL backend, when CA caching is enabled and an
`CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can
silently reinstall the cached store after the callback returns. A certificate
trusted by the cached store but rejected by the callback-selected store is
then incorrectly accepted.
Scoring
| CVSS | 7.5 () |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 0.41% probability of exploitation · percentile 32.7% · 2026-10-05T12:00:23Z |
| Last modified | 2026-09-15 |