{"id":"CVE-2026-9545","summary":"exposing HTTP/3 early data","details":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation.","aliases":["CURL-CVE-2026-9545"],"modified":"2026-10-24T14:23:49.168745969Z","published":"2026-07-03T06:17:55.931Z","related":["SUSE-SU-2026:22553-1","SUSE-SU-2026:22582-1","SUSE-SU-2026:22709-1","SUSE-SU-2026:22889-1","SUSE-SU-2026:2925-1","SUSE-SU-2026:2926-1","SUSE-SU-2026:3043-1","openSUSE-SU-2026:11230-1","openSUSE-SU-2026:21272-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9545.json","cna_assigner":"curl","cwe_ids":["CWE-200"]},"references":[{"type":"WEB","url":"https://curl.se/docs/CVE-2026-9545.html"},{"type":"WEB","url":"https://curl.se/docs/CVE-2026-9545.json"},{"type":"WEB","url":"https://hackerone.com/reports/3752888"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9545.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9545"},{"type":"PACKAGE","url":"https://github.com/curl/curl.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/curl/curl","events":[{"introduced":"b1ef0e1a01c0bb6ee5367bd9c186a603bde3615a"},{"fixed":"68720b4837284335b2d63cb358f8f6ce65f5bc55"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*","range":[{"introduced":"8.11.0"},{"fixed":"8.21.0"}],"source":"CPE_RANGE"}]}},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"962097b8dd44ed5b9e7984bc1cdffdbdd566857f"},{"fixed":"7b9613fa9b1a5e04301a3920eef58e8138dad05e"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"962097b8dd44ed5b9e7984bc1cdffdbdd566857f"},{"fixed":"7b9613fa9b1a5e04301a3920eef58e8138dad05e"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}}],"versions":["8.11.0","8.11.1","8.12.0","8.12.1","8.13.0","8.14.0","8.14.1","8.15.0","8.16.0","8.17.0","8.18.0","8.19.0","8.20.0","rc-8_21_0-3","rc-8_21_0-2","rc-8_21_0-1","curl-8_20_0","rc-8_20_0-3","rc-8_20_0-2","rc-8_20_0-1","curl-8_19_0","curl-8_18_0","curl-8_17_0","curl-8_16_0","curl-8_15_0","curl-8_14_1","curl-8_14_0","curl-8_13_0","curl-8_12_1","curl-8_12_0","curl-8_11_1","curl-8_11_0","rc-8_19_0-3","rc-8_19_0-2","rc-8_19_0-1","rc-8_18_0-3","rc-8_18_0-2","rc-8_18_0-1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-9545.json","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"153317582380559109273442960860016262309","length":1860},"id":"CVE-2026-9545-0d23da02","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/7b9613fa9b1a5e04301a3920eef58e8138dad05e","target":{"file":"lib/vquic/curl_ngtcp2.c","function":"cf_ngtcp2_handshake_completed"}},{"signature_version":"v1","source":"https://github.com/curl/curl.git/commit/7b9613fa9b1a5e04301a3920eef58e8138dad05e","target":{"file":"lib/vquic/curl_ngtcp2.c"},"deprecated":false,"digest":{"line_hashes":["57837649208692003109394932325481589562","148897155669795626335640653234286619658","9221967505252324245084890594736647812","229339314465024621466349949698476012120","316992347216962730835430776133092520281","138701791296620101350765089525540312140","296327085920196481168568880711169351555","5354081226792327714123399886029077496","60630981963415792295832576530337112547","123864576250417216190818910419145918435","142835053885326796857721237189839522787","192948789493812143984840421097894964353","280733359488708788015184071526492175907","111945068324397344898130947918406342943","315163984305334991863463999532320024294","61010276926023090237519678734162290207","49355929218012117922133473512437199901","7905145105583230885624546070173304809","57003410938242733606680334162856661189","299257298584114877497706458750155152547"],"threshold":0.9},"id":"CVE-2026-9545-54b362b4","signature_type":"Line"},{"target":{"function":"cf_ngtcp2_recv","file":"lib/vquic/curl_ngtcp2.c"},"deprecated":false,"digest":{"length":1412,"function_hash":"225529865282307993815272211670638534898"},"id":"CVE-2026-9545-837feabc","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/7b9613fa9b1a5e04301a3920eef58e8138dad05e"},{"signature_version":"v1","source":"https://github.com/curl/curl.git/commit/7b9613fa9b1a5e04301a3920eef58e8138dad05e","target":{"function":"cf_ngtcp2_send","file":"lib/vquic/curl_ngtcp2.c"},"deprecated":false,"digest":{"length":2382,"function_hash":"126594513254768600204067746099346311735"},"id":"CVE-2026-9545-8e6fa72c","signature_type":"Function"},{"source":"https://github.com/curl/curl.git/commit/7b9613fa9b1a5e04301a3920eef58e8138dad05e","target":{"file":"lib/vquic/curl_ngtcp2.c","function":"cf_ngtcp2_connect"},"deprecated":false,"digest":{"length":2392,"function_hash":"116844867287374578722968671244621372900"},"id":"CVE-2026-9545-d0afa7aa","signature_type":"Function","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-24T14:23:49Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}