An unauthenticated remote attacker can bypass certificate validation in the curl library when using the wolfSSL backend, leading to potential man-in-the-middle attacks.

This vulnerability is categorized as CWE-295 (Improper Certificate Validation). It occurs when the CURLOPT_SSL_CTX_FUNCTION callback is used to modify the trust store, but libcurl silently reinstalls the previously cached store, causing the application to incorrectly trust certificates that should have been rejected.

The vulnerability allows for successful man-in-the-middle attacks where an attacker can intercept, view, or manipulate encrypted traffic between the affected client and a remote server. With a CVSS score of 7.5 (High), this represents a significant risk to data confidentiality, as sensitive information such as credentials or proprietary data could be exposed to unauthorized parties.

Immediate Action: Monitor official release channels for the curl project to identify and apply the patched version as soon as it becomes available.

Proactive Monitoring: Review application logs for unusual TLS handshake patterns or errors related to certificate validation when using the wolfSSL backend.

Compensating Controls: If immediate patching is not possible, disable CA caching in the application configuration or switch to an alternative TLS backend that is not affected by this caching behavior.

Public Exploit Available: Unknown.

Given the high severity of this vulnerability and the potential for silent certificate validation bypass, organizations should prioritize the identification of all internal and external applications utilizing the curl library with the wolfSSL backend. Once a patch is released by the vendor, it must be deployed immediately to ensure the integrity of secure communications.