CVE-2026-82208: Haxx Curl

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.

Affected products

• Haxx Curl: from 8.9.1, before 8.22.0 (fixed in 8.22.0)

Published 2026-09-06. Last modified 2026-09-15.