CVE-2026-9545: libcurl HTTP/3 SSL Session Early Data Confidentiality Leak

Technical summary

The vulnerability stems from a race condition in libcurl's HTTP/3 implementation when handling SSL session resumption with early data transmission (0-RTT). When CURLOPT_SSL_SESSIONID_CACHE is enabled (the default) and the CURLSSLOPT_EARLYDATA flag is set in CURLOPT_SSL_OPTIONS, libcurl will transmit the client's request bytes on a new connection before completing certificate verification. In the attack scenario described, an attacker can replace a legitimate HTTP/3 server with an impostor machine lacking a valid certificate. Because the client has cached the previous SSL session, libcurl attempts session resumption and sends early data—application-layer bytes—before the certificate validation check executes. This allows the attacker to observe or intercept the sensitive information being transmitted. The flaw is rooted in the order of operations: early data dispatch occurs before the SSL/TLS handshake completes and certificate verification is enforced.

Business impact

For organizations using libcurl in client-side applications—including integrated library usage in tools, automation frameworks, and software development kits—this vulnerability could result in credential theft, API key exposure, or transmission of confidential request data to an attacker. The risk is amplified in environments where HTTPS is assumed to provide end-to-end confidentiality. Developers who have explicitly enabled early data transmission to optimize performance are at higher risk. Depending on the application's purpose and data sensitivity, a breach could lead to unauthorized access to downstream systems, compliance violations, or lateral movement within trusted networks. The fact that cached sessions are involved suggests that the vulnerability manifests during repeated connections, potentially affecting long-running services or batch processing workflows.

Affected systems

libcurl versions that support HTTP/3 and contain the SSL session caching and early data features are affected. The vulnerability requires specific configuration: CURLOPT_SSL_SESSIONID_CACHE must be enabled (which is the default), and CURLOPT_SSL_OPTIONS must have the CURLSSLOPT_EARLYDATA bit set. Applications are only at risk if they have explicitly enabled early data transmission; however, verify the exact affected version range and which libcurl deployments in your environment meet both conditions.

Exploitability

The attack requires a network-level capability: the attacker must be able to intercept and position themselves between the client and server. This could be achieved through ARP spoofing, DNS hijacking, BGP hijacking, or compromised network infrastructure on shared networks (Wi-Fi, ISP level, or cloud environments). The attacker does not require authentication or user interaction. The vulnerability is easier to exploit in environments with less mature network security or on open networks. However, the prerequisites—network positioning and the need for the application to have cached the legitimate session—narrow the threat to specific operational contexts rather than making it a universal remote code execution risk.

Remediation

Update libcurl to a patched version that addresses the SSL session resumption and early data handling. Verify against the vendor advisory for specific patched version numbers. As interim measures, disable early data transmission by not setting the CURLSSLOPT_EARLYDATA flag in CURLOPT_SSL_OPTIONS if performance allows, or disable SSL session caching by setting CURLOPT_SSL_SESSIONID_CACHE to 0 (though this reduces performance). Applications should prefer HTTPS pinning or certificate pinning where feasible to prevent man-in-the-middle attacks from fraudulent certificates. Network segmentation and encrypted tunnels (VPN, corporate proxies) reduce the attacker's ability to position themselves on the path.

Patch guidance

Apply the latest libcurl version released after 2026-07-03 that resolves this issue. Consult the official curl security advisory and release notes to confirm the patched version number. If your application statically links libcurl, recompile after updating. If libcurl is installed system-wide, update via your operating system's package manager or by building from source. Test patched versions in a development environment to ensure compatibility with your application's HTTP/3 usage patterns. Consider phased rollout in production if early data transmission is critical to performance. Monitor vendor communications for any follow-up patches or related issues.

Detection guidance

Look for libcurl processes or libraries in use within your environment and identify which versions are deployed using software inventory tools or package managers. Audit application source code and configuration for use of CURLOPT_SSL_EARLYDATA; enable logging of TLS handshake failures and certificate validation errors to spot potential attack attempts. Network intrusion detection systems should flag repeated connections to the same hostname followed by certificate verification failures, as this pattern matches the attack scenario. If you have the ability to monitor TLS session caches, unusual cache hits combined with certificate mismatches warrant investigation. Consider test connections to verify that certificate validation occurs before request data transmission.

Why prioritize this

This is rated HIGH severity (CVSS 7.5) because it enables direct confidentiality breaches under realistic network conditions. The vulnerability does not require patching a user's computer or exploiting memory corruption; instead, it exploits a logical flaw in protocol sequencing. The attack is passive from the client's perspective—no user action is needed. However, it is not rated CRITICAL because it requires network-level positioning, specific application configuration, and prior connection history. Organizations with strict network perimeter controls and those avoiding early data optimization are lower risk. This should be prioritized above less-exploitable flaws but may rank below vulnerabilities affecting default configurations or requiring only passive network observation.

Risk score, explained

CVSS 3.1 score of 7.5 reflects: Attack Vector Network (no physical access required), Attack Complexity Low (no special conditions beyond network positioning), Privileges Required None, User Interaction None, and Scope Unchanged with High Confidentiality Impact. There is no integrity or availability impact from the vulnerability itself—the attacker cannot modify responses or cause denial of service—hence the score does not reflect those dimensions. The score appropriately penalizes a confidentiality-only breach that can occur passively and at scale across networked applications.

Frequently asked questions