CVE-2026-9545
exposing HTTP/3 early data
Description
In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.
INFO
Published Date :
July 3, 2026, 6:17 a.m.
Last Modified :
July 3, 2026, 6:17 a.m.
Remotely Exploit :
No
Source :
curl
Affected Products
The following products are affected by CVE-2026-9545
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Disable the CURLSSLOPT_EARLYDATA option.
- Ensure certificate verification is not bypassed.
- Review SSL session caching configurations.
- Keep libcurl updated to the latest version.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-9545 vulnerability anywhere in the article.