Description
When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is
set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that
binding is not part of the connection reuse key, so a later transfer asking
for a different source can silently reuse an existing connection and go out
from the earlier transfer's source address
Published: 2026-10-20
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8927-1 curl vulnerabilities
Ubuntu USN Ubuntu USN USN-8927-2 curl vulnerabilities
History

Tue, 20 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in curl. When connection pooling is used with forced local interface binding options, curl fails to include the source interface configuration in its connection reuse cache. An attacker able to initiate network requests in an application using pooled connections can cause subsequent transfers to inadvertently reuse an existing connection. This behavior causes outbound network traffic to be transmitted through the wrong source address, potentially routing requests through an unintended network interface. When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address
Title curl: curl: local interface connection reuse mixup local interface connection reuse mixup
References

Sat, 17 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Curl
Curl curl
Vendors & Products Curl
Curl curl

Sat, 17 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in curl. When connection pooling is used with forced local interface binding options, curl fails to include the source interface configuration in its connection reuse cache. An attacker able to initiate network requests in an application using pooled connections can cause subsequent transfers to inadvertently reuse an existing connection. This behavior causes outbound network traffic to be transmitted through the wrong source address, potentially routing requests through an unintended network interface.
Title curl: curl: local interface connection reuse mixup
Weaknesses CWE-488
References
Metrics threat_severity

None

 cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

threat_severity

Low

Subscriptions

Curl Curl
cve-icon MITRE

Status: PUBLISHED

Assigner: curl

Published:

Updated: 2026-10-20T20:29:28.177Z

Reserved: 2026-10-09T07:51:38.463Z

Link: CVE-2026-107929

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T21:17:15.593

Modified: 2026-10-20T21:17:15.593

Link: CVE-2026-107929

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-14T12:00:00Z

Links: CVE-2026-107929 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T22:45:17Z

Weaknesses
  • CWE-488

    Exposure of Data Element to Wrong Session