CVE-2026-8286

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

Scoring

Severity

HIGH

CVSS base score

8.1

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS probability

0.31%

CWE

CWE-295

Published

2026-07-03

Last modified

2026-09-15

Affected products

• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl
• curl curl

Weakness type

• CWE-295

Related vulnerabilities

• CVE-2026-87608 — Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging so
• CVE-2026-66795 — Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)
• CVE-2026-78234 — Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users
• CVE-2026-85102 — Improper Certificate Validation in Quantum Security Gateway
• CVE-2026-32253 — Sunshine: Authentication bypass via improper client certificate validation
• CVE-2026-16835 — Power System Improper Certificate Validation
• CVE-2026-82180 — In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication polic
• CVE-2026-22093 — Adversary-in-the-Middle (AitM) attack vulnerability in EVbee Service app

Markdown version · Browse all CVEs