---
id: "CVE-2026-112103"
kind: "vulnerability"
aliases: ["CVE-2026-112103"]
title: "Fat-Free Framework: HTTP client skips TLS certificate checks in curl"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["fat-free-framework", "fatfree-core", "package", "php", "self-hosted"]
not_affected_if: ["no-outbound-http-client-use"]
published_at: "2026-10-19T11:17:16+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:01:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112103", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Fat-Free Framework: HTTP client skips TLS certificate checks in curl

The _curl function in the HTTP Client of fatfree-core up to 3.9.2 does not validate certificates properly when it makes outbound HTTPS requests. A remote attacker positioned on the network path could intercept or alter traffic the application sends to remote servers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of fatfree-core with `composer show f3-factory/fatfree-core` and look for anything at or below `3.9.2`.
- Search the application code for calls to the HTTP Client's `_curl` path in `web.php` where certificate verification is disabled.

## Fix

- Upgrade f3-factory/fatfree-core to `3.9.3` or later, which the sources say resolves the issue (upstream patch a2c755c8dc9ad0eb7d5fd261b09aff90f649433c).

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112103

## From the sources

A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. Upgrading to version 3.9.3 is able to resolve this issue. The name of the patch is a2c755c8dc9ad0eb7d5fd261b09aff90f649433c. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_