curl 8.22 Fixes Native CA Settings Crossing Reused Connections

The curl project published CVE-2026-80231 with curl 8.22.0 on September 2, 2026. The low-severity issue concerns HTTPS connection reuse on Windows and macOS. An existing connection could be reused for the same hostname even when the later transfer requested a different Native CA Store setting through CURLSSLOPT_NATIVE_CA.

That distinction matters because a reused TLS connection does not perform a new certificate handshake. If the connection pool treats two different trust configurations as equivalent, the later request may inherit the verification decision made when the connection was first established.

The issue affects both libcurl applications and the curl command-line tool. It is not a proxy-provider vulnerability, but proxy and data-collection teams often reuse clients, handles, and connection pools aggressively, so they should validate the actual trust boundary after upgrading.

Exact affected scope

The official advisory identifies:

• affected versions: curl 7.71.0 through 8.21.0;
• fixed versions: curl 8.22.0 and later;
• affected operating systems: Windows and macOS;
• affected behavior: reuse of an existing HTTPS connection when the Native CA Store setting differs from the setting used to create that connection;
• severity: Low.

Do not classify every curl deployment as exposed. Linux-only workers are outside the stated operating-system scope. A service that never varies its native-CA setting across transfers may not reach the vulnerable path. Inventory the runtime version, operating system, TLS configuration, and pooling behavior before prioritizing work.

Why this matters in proxy architectures

An HTTPS proxy and an HTTPS origin can create two independent TLS hops. The proxy certificate is controlled with proxy-specific trust settings; the origin certificate is controlled with origin trust settings. A successful request proves only that the connection in use was accepted under some configuration. It does not prove that the intended configuration created that connection.

Risk appears when one process serves workloads with different trust policies, for example:

• a public web collector using the operating system trust store;
• an internal research job using a private CA bundle;
• a regional worker changing trust options without rebuilding its pool;
• a long-running service reusing easy handles across tenants;
• a test harness alternating native and file-based CA modes against the same host;
• an HTTPS proxy client that correctly separates proxy trust but forgets to partition origin connections.

The safe rule is simple: every connection-pool key must include all settings that can change TLS identity or trust decisions.

Immediate response

1. Inventory curl and libcurl versions on Windows and macOS workers.
2. Identify applications that use CURLSSLOPT_NATIVE_CA, --ca-native, or equivalent wrapper options.
3. Locate shared handles, multi handles, connection caches, and long-lived client pools.
4. Upgrade affected systems to curl 8.22.0 or later, or apply the official patch through the normal dependency process.
5. Restart long-running workers so old libraries and established connections are removed.
6. Run a controlled trust-transition regression before returning mixed-policy pools to production.

The official temporary mitigation is to enable CURLOPT_FORBID_REUSE for transfers using the native CA store. That reduces connection reuse, so measure its latency and connection-cost impact. Treat it as a bridge to the fixed release rather than a permanent pooling design.

Build a safe regression matrix

Use test endpoints and certificates owned by your organization. Prepare two trust profiles:

• Profile A trusts the operating-system native store.
• Profile B trusts only a dedicated test CA or intentionally excludes the certificate accepted by Profile A.

For the same test hostname, execute this sequence in a fresh process:

1. connect with Profile A and record whether a new connection was created;
2. request the same hostname with Profile B through the same client pool;
3. confirm that the second request either establishes a new TLS connection under Profile B or fails certificate validation as designed;
4. reverse the order, starting with Profile B and then switching to Profile A;
5. repeat with connection reuse disabled as a control;
6. repeat after idle timeouts and pool eviction;
7. run the matrix on both Windows and macOS builds actually deployed.

Do not weaken verification or use --insecure to make the fixture pass. The test succeeds only when the observed certificate decision matches the active trust profile.

Separate proxy trust from origin trust

When an HTTPS proxy is present, record both handshakes separately:

• proxy hostname, certificate chain, trust source, and connection identifier;
• origin hostname, certificate chain, trust source, and connection identifier;
• whether the origin request used CONNECT tunneling;
• whether either TLS connection was newly created or reused;
• the native-CA flag and custom CA settings for each hop.

Use the TLS trust-profile isolation guide to design pool keys, and the proxy bypass audit to ensure a failed trusted route never silently becomes a direct request.

Never log private keys, proxy passwords, authorization headers, cookies, or complete sensitive URLs. A test-case identifier, hostname class, certificate fingerprint, selected trust-profile ID, and reuse decision are normally enough.

Acceptance criteria

A corrected client should satisfy all of these conditions:

• changing the Native CA Store setting cannot reuse a connection created with the previous setting;
• switching back to the original setting produces a decision consistent with that profile;
• proxy TLS and origin TLS settings remain independent;
• direct and proxied tests have explicit, attributable connection identifiers;
• certificate rejection remains a hard failure and does not trigger direct fallback;
• restarts load curl 8.22.0 or a verified patched build;
• telemetry identifies new versus reused connections without exposing credentials.

Deployment checklist

• [ ] Windows and macOS curl/libcurl versions are inventoried.
• [ ] Uses of native-CA options are mapped to owners and workloads.
• [ ] Shared connection pools are identified.
• [ ] Affected deployments are upgraded or patched.
• [ ] Long-running workers are restarted.
• [ ] Native-to-custom and custom-to-native transitions are tested.
• [ ] Proxy and origin trust settings are verified separately.
• [ ] Failure cannot fall back to an unauthorized direct route.
• [ ] Temporary no-reuse mitigation is removed after the fixed rollout.
• [ ] Logs and evidence are redacted.

FAQ

Does this issue affect Linux?

The curl advisory limits the bug to Windows and macOS. Confirm the operating system and actual binary in mixed fleets rather than assuming every worker is identical.

Is the curl command-line tool affected?

Yes. The advisory explicitly states that the command-line tool is affected, in addition to libcurl applications.

Does a residential proxy cause this problem?

No. The flaw is in curl's reuse decision for an HTTPS connection with different native-CA settings. A proxy may add another TLS hop and more pooling complexity, which is why both trust paths should be tested independently.

Is disabling reuse enough?

It is an official temporary mitigation for native-CA transfers, but it can reduce performance and does not replace upgrading. Use it only with measured operational impact and a removal plan.

Source and responsible-use note

Internal research basis: curl Project Security Advisory, “native CA store conn reuse,” CVE-2026-80231, published September 2, 2026; curl 8.22.0 release information. External research URLs are stored only in the internal operations record; this public article contains no external links.

Run certificate tests only against systems, endpoints, proxy accounts, and trust stores you own or are authorized to assess. Follow provider limits, destination terms, privacy requirements, and your organization's change-control process.