CVE-2026-92387

Awaiting Analysis Awaiting Analysis - Queue

libcurl Transfer Timeout Bypass via Missing Control Response

Publication date: 2026-10-20

Last updated on: 2026-10-29

Assigner: curl

Description

By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-92387

Affected Vendors & Products

Vendor	Product	Version / Range
curl	curl	8.22.0
curl	curl	8.21.0
curl	curl	8.20.0
curl	curl	8.19.0
curl	curl	8.18.0
curl	curl	8.17.0
curl	curl	8.16.0
curl	curl	8.15.0
curl	curl	8.14.1
curl	curl	8.14.0
curl	curl	8.13.0
curl	curl	8.12.1
curl	curl	8.12.0
curl	curl	8.11.1
curl	curl	8.11.0
curl	curl	8.10.1
curl	curl	8.10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability in libcurl allows a malicious FTP, IMAP, POP3, or SMTP server to bypass transfer timeout settings by omitting the final control-response line. This can indefinitely block all concurrent transfers using the same multi-handle.

Detection Guidance

This vulnerability involves a malicious server omitting the final control-response line to bypass libcurl's transfer timeout. Detection requires monitoring network traffic for FTP, IMAP, POP3, or SMTP sessions where the server fails to send the expected final response. Use packet capture tools like tcpdump or Wireshark to inspect traffic for incomplete protocol handshakes. Check libcurl logs for stalled transfers or timeouts that should have triggered but didn't.

Impact Analysis

This could cause applications using libcurl to hang indefinitely, leading to denial-of-service conditions for concurrent transfers. It may disrupt network services relying on timely data transfers.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service conditions through indefinite blocking of transfers. GDPR requires timely data processing and security, while HIPAA mandates availability of protected health information. The exploit may disrupt these requirements by preventing timely data transfers.

Mitigation Strategies

Update libcurl to the latest patched version immediately to address the timeout bypass issue. Monitor network traffic for suspicious FTP, IMAP, POP3, or SMTP server responses that omit final control lines. Disable concurrent transfers using multi-handles if possible until patched.

Hi! I’m here to help you understand CVE-2026-92387. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...