ALPINE-CVE-2026-86415

ALPINE-CVE-2026-86415

This page contains facts from public vulnerability sources. Check the original advisory before updating.

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.

Fix available

Published

2026-10-20T21:17:20.067Z

Updated

2026-10-25T16:30:03.601485502Z

Stack: system

Check your server →