{"id":"CVE-2026-107929","published":"2026-10-20T21:17:15.593","lastModified":"2026-10-22T17:21:57.293","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://curl.se/docs/CVE-2026-107929.html","tags":[]},{"url":"https://curl.se/docs/CVE-2026-107929.json","tags":[]},{"url":"https://hackerone.com/reports/4099618","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}