With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.

An update of the curl package has been released.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces
    the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate
    trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.
    (CVE-2026-82208)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces     the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate     trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.
    (CVE-2026-82208)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
375119	Photon OS 5.0: Curl PHSA-2026-5.0-92-1008	Nessus	PhotonOS Local Security Checks	Local	critical
375029	Photon OS 4.0: Curl PHSA-2026-4.0-1092	Nessus	PhotonOS Local Security Checks	Local	critical
375018	Photon OS 5.0: Curl PHSA-2026-5.0-90-1049	Nessus	PhotonOS Local Security Checks	Local	critical
375012	Photon OS 5.0: Curl PHSA-2026-5.0-91-1008	Nessus	PhotonOS Local Security Checks	Local	critical
476141	Echo: curl: security update to 1:8.22.0-1+e1curl-8.17.0: security update to 8.17.0+e1	Tenable Cloud Security	Echo Local Security Checks	Local	high
476141	Echo: curl: security update to 1:8.22.0-1+e1curl-8.17.0: security update to 8.17.0+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
342412	Linux Distros Unpatched Vulnerability : CVE-2026-82208	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-82208

high

Tenable Plugins

critical

critical

critical

critical

high

high

high