{"id":"CVE-2026-107929","kind":"vulnerability","aliases":["CVE-2026-107929"],"related":[],"title":"curl: connection reuse ignores interface binding, sending traffic from wrong source","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address","summary":"When curl is given an interface prefix such as if!, host! or ifhost! for CURLOPT_INTERFACE or --interface, that binding is left out of the connection reuse key. A later transfer requesting a different source can silently reuse an earlier connection and leave from the wrong source address.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","curl","libcurl","package","php","python"],"not_affected_if":["default-config"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T21:17:15+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:31+00:00","updated_at":"2026-10-25T05:04:31+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:04:31Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"curl: connection reuse ignores interface binding, sending traffic from wrong source","impact":"low","summary":"When curl is given an interface prefix such as if!, host! or ifhost! for CURLOPT_INTERFACE or --interface, that binding is left out of the connection reuse key. A later transfer requesting a different source can silently reuse an earlier connection and leave from the wrong source address.","category":"package","nicknames":[],"who_cares":["curl","libcurl","c","python","php"],"confidence":0.5,"needs_auth":"no","worst_case":"Transfers leave from an unintended source address, possibly exposing traffic on the wrong interface","analyst_note":"Confirm affected curl versions and fixed release from the NVD entry or curl project advisory; sources give no version info.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Applications or scripts using libcurl or the curl tool with CURLOPT_INTERFACE or --interface set to a prefixed value (if!, host!, ifhost!) across multiple transfers on the same handle or process. Systems that never set an interface prefix are not described as affected. unknown beyond that.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000566,"input_tokens":3330,"output_tokens":466,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107929':14A,17A '-2026':13A,16A 'address':71B,128C 'ask':108C 'bind':6A,43B,95C 'c':18B 'command':77C 'connect':2A,49B,64B,101C,118C 'curl':1A,19B,25B 'curlopt':38B,73C 'cve':12A,15A 'differ':57B,111C 'document':89C 'earlier':63B,124C 'exist':117C 'given':27B 'go':120C 'host':34B,92C 'ifhost':36B,93C 'ignor':4A 'interfac':5A,29B,39B,41B,74C,81C 'key':51B,103C 'later':53B,106C 'leav':66B 'left':45B 'libcurl':20B 'line':78C 'one':86C 'option':82C 'packag':21B 'part':98C 'php':22B 'prefix':30B,90C 'python':23B 'request':55B 'reus':3A,50B,61B,102C,115C 'send':7A 'set':84C 'silent':60B,114C 'sourc':11A,58B,70B,112C,127C 'tool':79C 'traffic':8A 'transfer':54B,107C,125C 'wrong':10A,69B","nicknames":[],"mitigations":[],"who_affected":"Applications or scripts using libcurl or the curl tool with CURLOPT_INTERFACE or --interface set to a prefixed value (if!, host!, ifhost!) across multiple transfers on the same handle or process. Systems that never set an interface prefix are not described as affected. unknown beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107929","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","severity":null,"published_at":"2026-10-20T21:17:15+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}