When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address

curl-8.23.0-1.1 on GA media

curl: libcurl: Curl out of bounds read for cookie path curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers curl: libcurl: Improper certificate validation due to cached TLS settings reuse curl: curl: stale SigV4 headers sent unintended curl: curl: redirect to SFTP or SCP bypasses host verification curl: curl: FTP connection reuse inherits client-certificate curl: curl: server-set cookie erases cookie jar curl: curl: Negotiate credentials sent to redirected origin curl: curl: leaking host credentials to HTTP proxy curl: curl: cross-origin reuse of a Negotiate connection curl: curl: HSTS cache import drops longer-lived child curl: curl: Hsts Response Erases Persisted Entries curl: IMAP APPEND plus CRLF conversion command injection curl: curl: knownhost callback mismatches key as missing curl: curl: wolfSSL public-key pinning bypass curl: curl: server-set cookie aborts cookie jar load curl: curl: never-ending loop via server response omission curl: curl: FTP wildcard write callback mixup curl: curl: TFTP direction confusion curl: curl: -J no-clobber guarantee bypassed with 103 early hints curl: curl: curl_mime_free stack overflow by recursion curl: curl: HTTP/2 upload Use-After-Free curl: curl: Authorization: Negotiate sent to foreign origin curl: curl: password leak in CURLINFO_EFFECTIVE_URL curl: curl: info leak uploading over WebSockets with GnuTLS curl: curl: local interface connection reuse mixup

Affected: Ubuntu:26.10: curl, Ubuntu:26.04:LTS: curl

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address.