{"cve":{"cve_id":"CVE-2026-11564","is_kev":false,"kev_date_added":null,"kev_vendor_project":null,"kev_product":null,"kev_vulnerability_name":null,"kev_short_description":null,"kev_required_action":null,"kev_due_date":null,"kev_known_ransomware":null,"kev_notes":null,"kev_cwes":null,"epss_score":0.00428,"epss_percentile":0.35578,"epss_as_of":"2026-10-15","description":"libcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup.\n\nAn easy handle that first uses default native CA trust can continue trusting\nthe native platform store after the application switches that same handle to\ncustom CA material for a later transfer.","published_at":"2026-07-03T06:12:35.251000Z","last_modified_at":"2026-09-15T07:16:25.530000Z","cvss_v3_score":9.1,"cvss_v3_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_v3_severity":"CRITICAL","cvss_v4_score":null,"cvss_v4_vector":null,"cvss_v4_severity":null,"ssvc_decision":null,"ssvc_exploitation":"poc","ssvc_automatable":false,"ssvc_technical_impact":"total","cwes":["CWE-295"],"nvd_references":["https://curl.se/docs/CVE-2026-11564.json","https://curl.se/docs/CVE-2026-11564.html","https://hackerone.com/reports/3788984"],"vuln_status":"Modified","trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-07-03T07:34:23.731878Z","updated_at":"2026-09-16T00:00:38.137528Z"},"effective_severity":"CRITICAL","badges":[],"impact_analysis":[],"cvss_v3_decoded":{"version":"3.1","metrics":[{"metric":"AV","name":"Attack Vector","value":"N","value_label":"Network"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"PR","name":"Privileges Required","value":"N","value_label":"None"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"S","name":"Scope","value":"U","value_label":"Unchanged"},{"metric":"C","name":"Confidentiality","value":"H","value_label":"High"},{"metric":"I","name":"Integrity","value":"H","value_label":"High"},{"metric":"A","name":"Availability","value":"N","value_label":"None"}]},"cvss_v4_decoded":{"version":null,"metrics":[]},"affected":[{"vendor_slug":"curl","vendor_name":"curl","product_slug":"curl","product_name":"curl","version_start":"8.17.0","version_start_inclusive":true,"version_end":"8.17.0","version_end_inclusive":true,"cpe23_uri":"cve5:curl:curl:8.17.0:8.17.0"},{"vendor_slug":"curl","vendor_name":"curl","product_slug":"curl","product_name":"curl","version_start":"8.19.0","version_start_inclusive":true,"version_end":"8.19.0","version_end_inclusive":true,"cpe23_uri":"cve5:curl:curl:8.19.0:8.19.0"},{"vendor_slug":"curl","vendor_name":"curl","product_slug":"curl","product_name":"curl","version_start":"8.18.0","version_start_inclusive":true,"version_end":"8.18.0","version_end_inclusive":true,"cpe23_uri":"cve5:curl:curl:8.18.0:8.18.0"},{"vendor_slug":"curl","vendor_name":"curl","product_slug":"curl","product_name":"curl","version_start":"8.20.0","version_start_inclusive":true,"version_end":"8.20.0","version_end_inclusive":true,"cpe23_uri":"cve5:curl:curl:8.20.0:8.20.0"},{"vendor_slug":"curl","vendor_name":"curl","product_slug":"curl","product_name":"curl","version_start":"eefd03c572996e5de4dec4fe295ad6f103e0eefc","version_start_inclusive":true,"version_end":"d69bfad3fa3daf5e72331f6870667607828d5891","version_end_inclusive":false,"cpe23_uri":"cve5:curl:curl:eefd03c572996e5de4dec4fe295ad6f103e0eefc:d69bfad3fa3daf5e72331f6870667607828d5891"},{"vendor_slug":"curl","vendor_name":"curl","product_slug":"curl","product_name":"curl","version_start":"8.17.0","version_start_inclusive":true,"version_end":"8.20.1","version_end_inclusive":false,"cpe23_uri":"cve5:curl:curl:8.17.0:8.20.1"},{"vendor_slug":"haxx","vendor_name":"haxx","product_slug":"curl","product_name":"curl","version_start":"8.17.0","version_start_inclusive":true,"version_end":"8.21.0","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"}],"exploit_refs":[],"news":[],"references":[{"url":"https://curl.se/docs/CVE-2026-11564.json","source_type":"MISC","tags":[]},{"url":"https://curl.se/docs/CVE-2026-11564.html","source_type":"MISC","tags":[]},{"url":"https://hackerone.com/reports/3788984","source_type":"MISC","tags":[]}],"timeline":[{"type":"published","at":"2026-07-03T06:12:35.251000Z","label":"CVE published","source":null},{"type":"ssvc_changed","at":"2026-07-06T17:42:58.941016Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-07-06T17:42:58.941016Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-07-06T17:42:58.941016Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"cvss_changed","at":"2026-07-06T17:42:58.941016Z","label":"CVSS score revised","source":"vulnrichment"},{"type":"cvss_changed","at":"2026-07-06T17:42:58.941016Z","label":"CVSS score revised","source":"vulnrichment"},{"type":"cvss_changed","at":"2026-07-06T17:42:58.941016Z","label":"CVSS score revised","source":"vulnrichment"}]}