Is the DLP vulnerable to CVE-2026-8932

Products

• Data Loss Prevention Core Package

Issue/Introduction

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

Resolution

This high-severity flaw causes libcurl to reuse a pooled TLS connection with the wrong client certificate when mTLS credentials are changed between requests using libcurl's certificate-path option parameters. This product loads client certificates through the OpenSSL SSL context callback mechanism rather than through libcurl's certificate option parameters — the specific code path the CVE targets is not exercised — and mTLS credentials are fixed at agent startup and never modified between requests. The exploit conditions cannot be met, resulting in a verdict of NOT_EXPLOITABLE.