# CVE-2026-82208

## Summary

- **CVE ID:** CVE-2026-82208
- **Severity:** HIGH
- **CVSS Score:** 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **CWE:** CWE-295
- **Published:** Sep 6, 2026
- **Last Modified:** Sep 16, 2026

## Description

With the wolfSSL backend, when CA caching is enabled and an
`CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can
silently reinstall the cached store after the callback returns. A certificate
trusted by the cached store but rejected by the callback-selected store is
then incorrectly accepted.

## Affected Products

- curl — curl (8.21.0)
- curl — curl (8.20.0)
- curl — curl (8.19.0)
- curl — curl (8.18.0)
- curl — curl (8.17.0)
- curl — curl (8.16.0)
- curl — curl (8.15.0)
- curl — curl (8.14.1)
- curl — curl (8.14.0)
- curl — curl (8.13.0)
- curl — curl (8.12.1)
- curl — curl (8.12.0)
- curl — curl (8.11.1)
- curl — curl (8.11.0)
- curl — curl (8.10.1)
- curl — curl (8.10.0)
- curl — curl (8.9.1)
- curl — curl (0f2876b2c33f6784a27b6f7345bd8cd95b46352a)

## References

- [CNA](https://curl.se/docs/CVE-2026-82208.json)
- [CNA](https://curl.se/docs/CVE-2026-82208.html)
- [CNA](https://hackerone.com/reports/3973090)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.43%
- **EPSS Percentile:** 36.2

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._