CVE-2026-111950: TLS session cache diff scheme reuse

curl 8.12.0 through 8.23.0 can reuse a TLS session created for an FTPS connection when opening an HTTPS connection to the same hostname and port. The TLS session-cache key contains the hostname, port, transport, TLS backend, and TLS configuration, but it does not contain the URL scheme or …

result = curlx_dyn_addf(&buf, "%s:%d:KEY-V2",
                        peer->origin->hostname, peer->origin->port);