25-Year-Old Vulnerability Patched in Curl

Overview

The curl project has released version 8.21.0, patching 18 vulnerabilities including a critical flaw that had quietly lurked in the open-source data transfer library for 25 years. The primary vulnerability, CVE-2026-8932, was present since curl 7.7 — released on March 22, 2001 — meaning it has existed across every version of the tool for a quarter century.

With curl installed on an estimated 30 billion devices worldwide, this release represents one of the broadest-reach patch releases in open-source software history.

The 25-Year Flaw: CVE-2026-8932

The long-lived vulnerability involves an mTLS (mutual TLS) connection reuse bug in libcurl. Under certain conditions, libcurl could reuse an existing connection even after client certificate or private key settings had changed.

This means:

• A subsequent request using a different client certificate could inadvertently use a connection authenticated with a previous certificate
• Applications relying on mTLS for per-request authentication could be fooled into accepting mismatched credentials
• In multi-tenant or shared connection pool scenarios, this could constitute an authentication bypass

Despite the severity of the scenario, the vulnerability is rated medium severity — no in-the-wild exploitation has been reported, and exploitation requires specific mTLS usage patterns.

Full Vulnerability List in curl 8.21.0

The release patches 18 vulnerabilities in total:

Discovery

The vulnerabilities were identified by Aisle, a security firm whose AI-powered platform systematically analyzed difficult-to-detect code paths in curl's codebase. Initial detection is credited to Anthropic's Mythos analysis platform in early May 2026, demonstrating the growing role of AI-assisted vulnerability research in finding long-dormant flaws.

Impact and Risk Assessment

While the potential attack surface is enormous — 30 billion devices — several factors limit immediate risk:

• No known active exploitation at time of disclosure
• The mTLS flaw specifically affects applications using mutual certificate authentication
• Many deployments use curl for simple HTTP transfers without client certificates, reducing exposure

However, organizations using curl (or libcurl) for:

• API authentication with client certificates
• Internal service-to-service mTLS
• VPN or zero-trust architectures relying on libcurl

...should treat this as high priority.

Mitigation

1. Upgrade to curl 8.21.0 immediately, particularly for any systems using mTLS or mutual authentication
2. Audit applications using libcurl directly — check for mTLS usage patterns that could be affected by connection reuse
3. Review connection pooling settings in applications that use libcurl with certificate-based auth
4. Monitor vendor patch timelines for distributions (Debian, Ubuntu, RHEL, etc.) to track when OS-level curl packages are updated

References

• SecurityWeek — 25-Year-Old Vulnerability Patched in Curl
• curl 8.21.0 Release Notes