Live › vulnerability › CVE-2026-107929
Go to dashboardWhen curl is given an interface prefix such as if!, host! or ifhost! for CURLOPT_INTERFACE or --interface, that binding is left out of the connection reuse key. A later transfer requesting a different source can silently reuse an earlier connection and leave from the wrong source address.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications or scripts using libcurl or the curl tool with CURLOPT_INTERFACE or --interface set to a prefixed value (if!, host!, ifhost!) across multiple transfers on the same handle or process. Systems that never set an interface prefix are not described as affected. unknown beyond that.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When CURLOPT_INTERFACE (or the command line tool's --interface option) is
set with one of the documented prefixes (if!, host!, ifhost!), that
binding is not part of the connection reuse key, so a later transfer asking
for a different source can silently reuse an existing connection and go out
from the earlier transfer's source address
This page as .md · .json · in your agent: get_signal("CVE-2026-107929")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.