CVE-2026-82208

A flaw was found in libcurl when using the wolfSSL backend. When CA (Certificate Authority) caching is enabled and a CURLOPT_SSL_CTX_FUNCTION callback is used to replace the trust store, libcurl can silently reinstall the cached store. This can lead to a scenario where a certificate that should be rejected by the callback-selected store is incorrectly accepted if it is trusted by the cached store, resulting in improper certificate validation.

This issue only affects curl/libcurl built with the wolfSSL TLS backend. Red Hat does not ship wolfSSL as the TLS backend for curl in supported products; shipped curl uses OpenSSL (or historically NSS). Therefore Red Hat products are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.