From: Daniel Stenberg Date: Tue, 24 Mar 2026 08:35:08 +0100 Subject: [PATCH] url: do not reuse a non-tls starttls connection if new requires TLS Reported-by: Arkadi Vainbrand Closes #21082 Backported-by: Samuel Henrique * Refresh patch context for lib/url.c --- lib/url.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/url.c b/lib/url.c index efd50a0..dab5093 100644 --- a/lib/url.c +++ b/lib/url.c @@ -804,7 +804,7 @@ struct url_conn_match { BIT(want_proxy_ntlm_http); BIT(want_nego_http); BIT(want_proxy_nego_http); - + BIT(req_tls); /* require TLS use from a clear-text start */ BIT(wait_pipe); BIT(force_reuse); BIT(seen_pending_conn); @@ -955,6 +955,9 @@ static bool url_match_ssl_use(struct connectdata *conn, if(get_protocol_family(conn->handler) != m->needle->handler->protocol) return FALSE; } + else if(m->req_tls) + /* a clear-text STARTTLS protocol with required TLS */ + return FALSE; return TRUE; } @@ -1417,6 +1420,7 @@ ConnectionExists(struct Curl_easy *data, (needle->handler->protocol & PROTO_FAMILY_HTTP); #endif #endif + match.req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL; /* Find a connection in the pool that matches what "data + needle" * requires. If a suitable candidate is found, it is attached to "data". */