FTP Control Connection Reuse with Client Certificate in cURL

Executive Summary

CVE-2026-86411 is a vulnerability in curl where an FTP transfer configured without SSL (CURLUSESSL_NONE) can reuse a pooled FTP control connection that was previously upgraded with STARTTLS and authenticated using a client certificate. The second connection does not perform a new TLS handshake or FTP login, so the server continues to authorize it under the first connection's certificate identity.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses curl versions 8.21.0 or earlier. Run 'curl --version' to verify the installed version. If it is 8.21.0 or older, the system is vulnerable. Additionally, inspect FTP connections for reused control connections without new TLS handshakes or FTP logins.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized access to FTP servers if an attacker reuses a pooled connection with a client certificate. It may lead to data exposure or privilege escalation if the server relies on certificate-based authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with standards requiring secure data transmission and authentication, such as GDPR's encryption requirements or HIPAA's safeguards for protected health information. If client certificates are used for authentication in FTP transfers, unauthorized reuse of these certificates due to connection pooling may lead to improper access controls or data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade curl to version 8.22.0 or later. If upgrading is not possible, avoid using client certificates for FTP transfers. Apply the official patch from curl's repository if available.

Useful 0 Not Useful 0