curl 8.22 Fixes wolfSSL CA-Cache Trust Override: A Proxy Client Audit

The curl project published CVE-2026-82208 on September 2, 2026, together with curl 8.22.0. The advisory describes a narrow certificate-validation flaw in libcurl builds that use the wolfSSL TLS backend, enable CA caching, and replace the trust store through a CURLOPT_SSL_CTX_FUNCTION callback.

In that combination, libcurl could silently reinstall the cached CA store after the callback returned. A certificate accepted by the cached store but rejected by the callback-selected store could then be accepted incorrectly. The curl project rates the issue Low.

This is relevant to proxy-enabled automation because applications often embed libcurl behind SDKs, collectors or verification workers. It does not mean every curl request or every proxy connection is affected. The command-line curl tool is not affected, and builds using other TLS backends are outside the advisory’s stated scope.

Confirm the exact exposure conditions

Treat a deployment as potentially affected only when all of these conditions are true or unknown:

1. The running library is libcurl 8.9.1 through 8.21.0.
2. It is built with the wolfSSL TLS backend.
3. CA caching is enabled.
4. The application installs a CURLOPT_SSL_CTX_FUNCTION callback.
5. That callback replaces or changes the trust store.

The advisory lists versions before 8.9.1 and versions 8.22.0 or later as unaffected. Do not infer the runtime library from the curl binary on the same host; an application may bundle or dynamically load a different build.

Inventory the library, backend and callback

Start with deployed artifacts rather than source-repository assumptions. For each service, record:

application_build
loaded_libcurl_version
tls_backend
ca_cache_enabled
ssl_context_callback_present
trust_store_replaced
deployment_region

Use aliases for applications and trust profiles. Never log CA private material, proxy passwords, tokens, cookies or customer identifiers.

Pay special attention to long-running data-collection, ad-verification and market-research workers that reuse TLS configuration or shared handles. The exposure is about trust-store selection, not residential IP rotation, proxy session stickiness or DNS behavior.

Apply the project’s remediation order

The curl advisory recommends, in order:

1. upgrade curl and libcurl to 8.22.0;
2. apply the project patch and rebuild the affected version;
3. avoid using CURLOPT_SSL_CTX_FUNCTION with the wolfSSL backend if the first two options are temporarily impossible.

An operationally safe upgrade should confirm the library loaded by the process, restart workers that could retain old state, and retain a tested rollback artifact. A rollback must not reintroduce the affected trust path; use it only for unrelated compatibility issues and preserve the patched component.

Build a trust-isolation canary

Use a test endpoint and certificates created for an authorized laboratory environment. Do not test with public sites or attempt to generate misleading certificates for third-party names.

Create two test trust profiles:

• the cached baseline trusts test CA A;
• the callback-selected profile trusts test CA B and rejects A.

Then run a controlled sequence:

1. initialize the affected-style client configuration in an isolated build;
2. populate the CA cache with the baseline profile;
3. install the callback-selected profile;
4. connect to an endpoint presenting a certificate from test CA A;
5. assert that the connection is rejected;
6. connect to the test CA B endpoint and assert that it succeeds;
7. repeat on libcurl 8.22.0 with connection reuse and process restarts.

The pass condition is the callback-selected trust decision. A successful TCP connection, HTTP response or proxy tunnel alone is not sufficient.

Separate proxy trust from destination trust

Applications may validate both a proxy TLS connection and an origin TLS connection. Document which trust store and callback applies at each boundary. A test matrix should include:

Do not disable certificate verification to make a canary pass. That removes the security property the test is designed to verify.

Watch for rollout regressions

During the canary, monitor certificate-verification failures by sanitized reason class, TLS handshake latency, new connection rate, proxy tunnel success, first-attempt request success and bounded retry volume. A rise in correctly rejected certificates may reveal that earlier trust behavior was too broad; investigate rather than weakening validation.

Avoid unlimited retries. Certificate rejection is not a signal to rotate proxy exits or switch to direct traffic. Those actions can obscure the trust failure without correcting it.

Upgrade checklist

• [ ] Actual loaded libcurl versions are known.
• [ ] TLS backends are identified per artifact.
• [ ] wolfSSL builds from 8.9.1 through 8.21.0 are located.
• [ ] CA-cache use is confirmed or ruled out.
• [ ] SSL context callbacks and trust replacement are inventoried.
• [ ] libcurl 8.22.0 or the official patch is deployed.
• [ ] Long-lived workers are restarted or drained.
• [ ] Test CA A is rejected after profile replacement.
• [ ] Test CA B remains accepted as intended.
• [ ] Proxy and origin trust boundaries are tested separately.
• [ ] No verification bypass was introduced.
• [ ] Logs and fixtures contain no credentials or private material.

Related 98IP guidance covers proxy credential rotation, curl proxy authentication 407 troubleshooting, and proxy failover recovery drills.

FAQ

Does this affect command-line curl?

No. The curl advisory explicitly says the command-line tool is not affected. The relevant path is an application using libcurl with the specified wolfSSL, CA-cache and callback conditions.

Are OpenSSL or other TLS backends affected?

The advisory states that this issue exists only with the wolfSSL backend. Inventory the actual runtime backend rather than assuming it from build documentation.

Should we disable certificate verification temporarily?

No. That would create a broader and more serious trust failure. Upgrade, patch, or avoid the affected callback combination as documented by curl.

Will rotating the proxy IP mitigate the issue?

No. Proxy rotation changes routing, not which CA store the client uses to validate a certificate.

Compliance note

Use only controlled certificates, domains and endpoints that you own or are authorized to test. Protect trust-store material, follow incident-response and change-control requirements, and use proxies only for lawful workloads that respect destination terms, privacy rules and rate limits.

Source note: curl project, “wolfSSL CA-cache hit overrides callback,” CVE-2026-82208, published September 2, 2026; curl 8.22.0 release notes, September 2, 2026.