CVE-2026-86415 — auto client cert connection reuse mixup
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a tran…
Published: 2026-10-20 · CVSS: Unscored
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7