{
  "threat_severity" : "Moderate",
  "public_date" : "2026-07-03T06:12:35Z",
  "bugzilla" : {
    "description" : "libcurl: libcurl: Certificate validation bypass due to incorrect connection reuse",
    "id" : "2496754",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2496754"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-295",
  "details" : [ "libcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup.\nAn easy handle that first uses default native CA trust can continue trusting\nthe native platform store after the application switches that same handle to\ncustom CA material for a later transfer.", "A flaw was found in curl. When libcurl reuses a connection from its connection pool, an easy handle that initially used default native Certificate Authority (CA) trust may continue to trust the native platform store. This occurs even after the application has switched that same handle to custom CA material for a subsequent transfer, potentially bypassing intended certificate validation." ],
  "statement" : "This Moderate flaw in curl allows a certificate validation bypass. When libcurl reuses a connection, an application that switches from default native CA trust to custom CA material on the same handle may inadvertently continue to trust the native platform store. This could lead to a bypass of intended certificate validation, as the custom CA material might not be correctly applied, potentially allowing connections to untrusted endpoints.",
  "affected_release" : [ {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-24T00:00:00Z",
    "advisory" : "RHSA-2026:29017",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "curl-main-8.21.0-0.1.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-02T00:00:00Z",
    "advisory" : "RHSA-2026:34975",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "rust-main-1.96.1-1.hum1"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "dotnet8.0",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Affected",
    "package_name" : "libcurl-1.dll",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Affected",
    "package_name" : "libcurl.so",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-11564\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-11564\nhttps://curl.se/docs/CVE-2026-11564.html\nhttps://curl.se/docs/CVE-2026-11564.json\nhttps://hackerone.com/reports/3788984" ],
  "name" : "CVE-2026-11564",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}