---
id: CVE-2026-107929
title: local interface connection reuse mixup
summary: |-
  When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is
  set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that
  binding is not part of the connection reuse key, so a later transfer asking
  for a dif…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-488
vendor: curl
product: curl
affected:
  - curl >= 8.22.0 <= 8.22.0
  - curl >= 8.21.0 <= 8.21.0
  - curl >= 8.20.0 <= 8.20.0
  - curl >= 8.19.0 <= 8.19.0
  - curl >= 8.18.0 <= 8.18.0
  - curl >= 8.17.0 <= 8.17.0
  - curl >= 8.16.0 <= 8.16.0
  - curl >= 8.15.0 <= 8.15.0
  - curl >= 8.14.1 <= 8.14.1
  - curl >= 8.14.0 <= 8.14.0
  - curl >= 8.13.0 <= 8.13.0
  - curl >= 8.12.1 <= 8.12.1
  - curl >= 8.12.0 <= 8.12.0
  - curl >= 8.11.1 <= 8.11.1
  - curl >= 8.11.0 <= 8.11.0
  - curl >= 8.10.1 <= 8.10.1
  - curl >= 8.10.0 <= 8.10.0
  - curl >= 8.9.1 <= 8.9.1
  - curl >= 8.9.0 <= 8.9.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T16:30:50.273989Z'
exploitAvailable: true
published: '2026-10-20'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T16:31:15.917Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107929'
references:
  - url: 'https://curl.se/docs/CVE-2026-107929.json'
    label: json
  - url: 'https://curl.se/docs/CVE-2026-107929.html'
    label: www
  - url: 'https://hackerone.com/reports/4099618'
    label: issue
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107929.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-107929'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2550721'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-107929'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107929'
  - url: 'https://access.redhat.com/errata/RHSA-2026:82895'
tags:
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00667
epssPercentile: 0.51991
patched:
  - hardened_images
scores:
  adp: 8.1
  vendor: 3.7
ingestedAt: '2026-10-20T21:19:21.269Z'
---

## Overview

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is
set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that
binding is not part of the connection reuse key, so a later transfer asking
for a different source can silently reuse an existing connection and go out
from the earlier transfer's source address

## Affected

- `curl >= 8.22.0 <= 8.22.0`
- `curl >= 8.21.0 <= 8.21.0`
- `curl >= 8.20.0 <= 8.20.0`
- `curl >= 8.19.0 <= 8.19.0`
- `curl >= 8.18.0 <= 8.18.0`
- `curl >= 8.17.0 <= 8.17.0`
- `curl >= 8.16.0 <= 8.16.0`
- `curl >= 8.15.0 <= 8.15.0`
- `curl >= 8.14.1 <= 8.14.1`
- `curl >= 8.14.0 <= 8.14.0`
- `curl >= 8.13.0 <= 8.13.0`
- `curl >= 8.12.1 <= 8.12.1`
- `curl >= 8.12.0 <= 8.12.0`
- `curl >= 8.11.1 <= 8.11.1`
- `curl >= 8.11.0 <= 8.11.0`
- `curl >= 8.10.1 <= 8.10.1`
- `curl >= 8.10.0 <= 8.10.0`
- `curl >= 8.9.1 <= 8.9.1`
- `curl >= 8.9.0 <= 8.9.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:82895** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:82895)
- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat JBoss Core Services, Red Hat Satellite 6 · no fix planned: Red Hat JBoss Core Services, Red Hat Satellite 6, Red Hat Enterprise Linux 10 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107929.json)