Reported by 1 outlet
25-Year-Old Curl Vulnerability (CVE-2026-8932) — AI-Discovered Flaw Allows Connection Reuse After Certificate Change
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 3.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
25-Year-Old Curl Vulnerability (CVE-2026-8932) — AI-Discovered Flaw Allows Connection Reuse After Certificate Change
securityweek.com · 111d ago · June 25th, 2026
AISLE's autonomous vulnerability detection platform identified the oldest security issue ever reported in curl, a bug dating back approximately 25 years. CVE-2026-8932 exists because libcurl could reuse an existing connection even after client certificate or private key settings had changed, potentially exposing credentials to the wrong endpoint. Fixed in curl release 8.21.0 (June 24, 2026). AISLE discovered 6 CVEs in curl total this year.
The curl project noted this is the oldest vulnerability ever found in the tool, underscoring both the value of AI-assisted code auditing for legacy codebases and the difficulty of discovering subtle logical errors in decades-old network protocol implementations.