CVE-2026-80231

A flaw was found in libcurl. This vulnerability allows libcurl to incorrectly reuse an existing HTTPS connection for a given hostname, even when a different Native CA Store setting (CURLSSLOPT_NATIVE_CA) is specified for the new connection. This could potentially lead to a client trusting a malicious server if the initial connection used a less strict CA store than intended for subsequent connections.

This Low impact flaw in libcurl arises from incorrect reuse of HTTPS connections when the CURLSSLOPT_NATIVE_CA option is employed with differing Native CA Store settings. This flaw does not affect any Red Hat products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.