CVE-2026-9545

In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate.

When libcurl returns to the hostname the second time with a cached SSL session (CURLOPT_SSL_SESSIONID_CACHE is not disabled) and early data enabled (the CURLSSLOPT_EARLYDATA bit is set in CURLOPT_SSL_OPTIONS), libcurl might send off the second request's bytes on that new connection before enforcing the certificate verification failure. Potentially leaking sensitive information.

Database specific

{
    "cna_assigner": "curl",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9545.json"
}

References

Affected packages

Git / github.com/curl/curl.git

Affected ranges

Type

GIT

Repo

https://github.com/curl/curl.git

Events

Introduced

962097b8dd44ed5b9e7984bc1cdffdbdd566857f

Fixed

7b9613fa9b1a5e04301a3920eef58e8138dad05e

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "962097b8dd44ed5b9e7984bc1cdffdbdd566857f"
                },
                {
                    "fixed": "7b9613fa9b1a5e04301a3920eef58e8138dad05e"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

8.*

8.11.0

8.11.1

8.12.0

8.12.1

8.13.0

8.14.0

8.14.1

8.15.0

8.16.0

8.17.0

8.18.0

8.19.0

8.20.0

Other

curl-8_11_0

curl-8_11_1

curl-8_12_0

curl-8_12_1

curl-8_13_0

curl-8_14_0

curl-8_14_1

curl-8_15_0

curl-8_16_0

curl-8_17_0

curl-8_18_0

curl-8_19_0

curl-8_20_0

rc-8_18_0-1

rc-8_18_0-2

rc-8_18_0-3

rc-8_19_0-1

rc-8_19_0-2

rc-8_19_0-3

rc-8_20_0-1

rc-8_20_0-2

rc-8_20_0-3

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-9545.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "153317582380559109273442960860016262309",
            "length": 1860
        },
        "id": "CVE-2026-9545-0d23da02",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/curl/curl.git/commit/7b9613fa9b1a5e04301a3920eef58e8138dad05e",
        "target": {
            "file": "lib/vquic/curl_ngtcp2.c",
            "function": "cf_ngtcp2_handshake_completed"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "57837649208692003109394932325481589562",
                "148897155669795626335640653234286619658",
                "9221967505252324245084890594736647812",
                "229339314465024621466349949698476012120",
                "316992347216962730835430776133092520281",
                "138701791296620101350765089525540312140",
                "296327085920196481168568880711169351555",
                "5354081226792327714123399886029077496",
                "60630981963415792295832576530337112547",
                "123864576250417216190818910419145918435",
                "142835053885326796857721237189839522787",
                "192948789493812143984840421097894964353",
                "280733359488708788015184071526492175907",
                "111945068324397344898130947918406342943",
                "315163984305334991863463999532320024294",
                "61010276926023090237519678734162290207",
                "49355929218012117922133473512437199901",
                "7905145105583230885624546070173304809",
                "57003410938242733606680334162856661189",
                "299257298584114877497706458750155152547"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-9545-54b362b4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/curl/curl.git/commit/7b9613fa9b1a5e04301a3920eef58e8138dad05e",
        "target": {
            "file": "lib/vquic/curl_ngtcp2.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "225529865282307993815272211670638534898",
            "length": 1412
        },
        "id": "CVE-2026-9545-837feabc",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/curl/curl.git/commit/7b9613fa9b1a5e04301a3920eef58e8138dad05e",
        "target": {
            "file": "lib/vquic/curl_ngtcp2.c",
            "function": "cf_ngtcp2_recv"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "126594513254768600204067746099346311735",
            "length": 2382
        },
        "id": "CVE-2026-9545-8e6fa72c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/curl/curl.git/commit/7b9613fa9b1a5e04301a3920eef58e8138dad05e",
        "target": {
            "file": "lib/vquic/curl_ngtcp2.c",
            "function": "cf_ngtcp2_send"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "116844867287374578722968671244621372900",
            "length": 2392
        },
        "id": "CVE-2026-9545-d0afa7aa",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/curl/curl.git/commit/7b9613fa9b1a5e04301a3920eef58e8138dad05e",
        "target": {
            "file": "lib/vquic/curl_ngtcp2.c",
            "function": "cf_ngtcp2_connect"
        }
    }
]

vanir_signatures_modified

"2026-10-22T16:35:04Z"