CVE-2026-82208: curl curl advisory

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

What it is

With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.

Description quoted from the CVE record (assigned by curl, published 2026-09-06).

Weakness: Improper Certificate Validation; CWE-295 Improper Certificate Validation

How it can be exploited

Exploitable over the network with low attack complexity needing no privileges and no user interaction. Impact: confidentiality high, integrity none, availability none. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA assessment (SSVC): CISA assesses that a public proof of concept exists. Automatable: yes. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Also known as: EUVD-2026-72152, GHSA-8rq8-f59m-9cjg

VEDAS cluster: VEDAS:FRETFROG

Exploit Observer has no public exploit code that names this CVE or one of its aliases.

Research and write-ups (2)

Research or write-up: https://curl.se/docs/CVE-2026-82208.html
Research or write-up: https://curl.se/docs/CVE-2026-82208.json

Vulnerability databases and vendor advisories (9)

Catalogue entries, not exploit evidence.

Vulnerability database or vendor advisory: https://euvd.enisa.europa.eu/enisa/EUVD-2026-72152
Vulnerability database or vendor advisory: https://github.com/advisories/GHSA-8rq8-f59m-9cjg
Vulnerability database or vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-82208
Vulnerability database or vendor advisory: https://osv.dev/vulnerability/CURL-CVE-2026-82208
Vulnerability database or vendor advisory: https://osv.dev/vulnerability/ROOT-OS-ALPINE-320-CVE-2026-82208
Vulnerability database or vendor advisory: https://osv.dev/vulnerability/ROOT-OS-ALPINE-321-CVE-2026-82208
Vulnerability database or vendor advisory: https://osv.dev/vulnerability/ROOT-OS-ALPINE-322-CVE-2026-82208
Vulnerability database or vendor advisory: https://osv.dev/vulnerability/UBUNTU-CVE-2026-82208
Vulnerability database or vendor advisory: https://ubuntu.com/security/CVE-2026-82208

2 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.

VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.

Live scores

EPSS: 0.004
low predicted chance of attack
VEDAS: 0.987
strong exploit evidence
On CISA KEV: Not listed
Detection rule: None yet

Who is affected

Product	Affected	Not affected
curl curl	from 8.9.1 before 8.14.2 from 8.15.0 before 8.16.1 from 8.17.0 before 8.20.1 from 8.21.0 before 8.22.0	Not stated
curl curl	from 0f2876b2c33f before ed0338befd1d (git commit)	Not stated
curl curl	version 8.21.0 version 8.20.0 version 8.19.0 version 8.18.0 version 8.17.0 version 8.16.0 version 8.15.0 version 8.14.1 and 9 more ranges	Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

Exploit Observer also maps it to: haxx curl.

How to fix it

Fixed versions stated in the CVE record: 8.14.2, 8.16.1, 8.20.1, 8.22.0.

How to detect it

There is no open VEDAS detection rule for this bug yet. It is listed on the detection gaps page if CISA has confirmed attacks.

References

Other references

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.