{
  "cveId": "CVE-2026-11564",
  "url": "https://patchblox.com/security/cve/CVE-2026-11564",
  "summary": "CVE-2026-11564 is fixed in 3 products on 1 platform, first by curl 8.18.0-1ubuntu2.3, released June 24, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "curl: libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them match...",
  "description": "libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup.  An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.",
  "published": "2026-06-24T07:00:00Z",
  "severity": "critical",
  "cvss": 9.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss": 0.0061,
  "epssPercentile": 0.49506,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "curl",
      "release": "Debian 14",
      "fixedVersion": "8.21.0~rc2-1",
      "fix": "DEBIAN-CVE-2026-11564",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-11564",
      "released": "2026-07-24T13:34:41Z"
    },
    {
      "platform": "linux",
      "product": "curl",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "8.18.0-1ubuntu2.3",
      "fix": "curl 8.18.0-1ubuntu2.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-curl-8.18.0-1ubuntu2.3",
      "released": "2026-06-24T07:00:00Z"
    },
    {
      "platform": "linux",
      "product": "curl",
      "release": "sles 15.6",
      "fixedVersion": "8.22.0-150600.4.58.1",
      "fix": "SUSE-SU-2026:5069-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5069-1",
      "released": "2026-11-07T00:42:08Z"
    },
    {
      "platform": "linux",
      "product": "curl",
      "release": "sles 15.7",
      "fixedVersion": "8.22.0-150700.7.33.1",
      "fix": "SUSE-SU-2026:5068-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5068-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "libcurl3t64-gnutls",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "8.18.0-1ubuntu2.3",
      "fix": "libcurl3t64-gnutls 8.18.0-1ubuntu2.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libcurl3t64-gnutls-8.18.0-1ubuntu2.3",
      "released": "2026-06-24T07:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libcurl4t64",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "8.18.0-1ubuntu2.3",
      "fix": "libcurl4t64 8.18.0-1ubuntu2.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libcurl4t64-8.18.0-1ubuntu2.3",
      "released": "2026-06-24T07:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}