TFTP State Confusion in libcurl Leading to Data Leak

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: curl

Description

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-92389

Affected Vendors & Products

Vendor	Product	Version / Range
curl	curl	8.22.0
curl	curl	8.21.0
curl	curl	8.20.0
curl	curl	8.19.0
curl	curl	8.18.0
curl	curl	8.17.0
curl	curl	8.16.0
curl	curl	8.15.0
curl	curl	8.14.1
curl	curl	8.14.0
curl	curl	8.13.0
curl	curl	8.12.1
curl	curl	8.12.0
curl	curl	8.11.1
curl	curl	8.11.0
curl	curl	8.10.1
curl	curl	8.10.0
curl	curl	8.9.1
curl	curl	8.9.0
curl	curl	8.8.0
curl	curl	8.7.1
curl	curl	8.7.0
curl	curl	8.6.0
curl	curl	8.5.0
curl	curl	8.4.0
curl	curl	8.3.0
curl	curl	8.2.1
curl	curl	8.2.0
curl	curl	8.1.2
curl	curl	8.1.1
curl	curl	8.1.0
curl	curl	8.0.1
curl	curl	8.0.0
curl	curl	7.88.1
curl	curl	7.88.0
curl	curl	7.87.0
curl	curl	7.86.0
curl	curl	7.85.0
curl	curl	7.84.0
curl	curl	7.83.1
curl	curl	7.83.0
curl	curl	7.82.0
curl	curl	7.81.0
curl	curl	7.80.0
curl	curl	7.79.1
curl	curl	7.79.0
curl	curl	7.78.0
curl	curl	7.77.0
curl	curl	7.76.1
curl	curl	7.76.0
curl	curl	7.75.0
curl	curl	7.74.0
curl	curl	7.73.0
curl	curl	7.72.0
curl	curl	7.71.1
curl	curl	7.71.0
curl	curl	7.70.0
curl	curl	7.69.1
curl	curl	7.69.0
curl	curl	7.68.0
curl	curl	7.67.0
curl	curl	7.66.0
curl	curl	7.65.3
curl	curl	7.65.2
curl	curl	7.65.1
curl	curl	7.65.0
curl	curl	7.64.1
curl	curl	7.64.0
curl	curl	7.63.0
curl	curl	7.62.0
curl	curl	7.61.1
curl	curl	7.61.0
curl	curl	7.60.0
curl	curl	7.59.0
curl	curl	7.58.0
curl	curl	7.57.0
curl	curl	7.56.1
curl	curl	7.56.0
curl	curl	7.55.1
curl	curl	7.55.0
curl	curl	7.54.1
curl	curl	7.54.0
curl	curl	7.53.1
curl	curl	7.53.0
curl	curl	7.52.1
curl	curl	7.52.0
curl	curl	7.51.0
curl	curl	7.50.3
curl	curl	7.50.2
curl	curl	7.50.1
curl	curl	7.50.0
curl	curl	7.49.1
curl	curl	7.49.0
curl	curl	7.48.0
curl	curl	7.47.1
curl	curl	7.47.0
curl	curl	7.46.0
curl	curl	7.45.0
curl	curl	7.44.0
curl	curl	7.43.0
curl	curl	7.42.1
curl	curl	7.42.0
curl	curl	7.41.0
curl	curl	7.40.0
curl	curl	7.39.0
curl	curl	7.38.0
curl	curl	7.37.1
curl	curl	7.37.0
curl	curl	7.36.0
curl	curl	7.35.0
curl	curl	7.34.0
curl	curl	7.33.0
curl	curl	7.32.0
curl	curl	7.31.0
curl	curl	7.30.0
curl	curl	7.29.0
curl	curl	7.28.1
curl	curl	7.28.0
curl	curl	7.27.0
curl	curl	7.26.0
curl	curl	7.25.0
curl	curl	7.24.0
curl	curl	7.23.1
curl	curl	7.23.0
curl	curl	7.22.0
curl	curl	7.21.7
curl	curl	7.21.6
curl	curl	7.21.5
curl	curl	7.21.4
curl	curl	7.21.3
curl	curl	7.21.2
curl	curl	7.21.1
curl	curl	7.21.0
curl	curl	7.20.1
curl	curl	7.20.0
curl	curl	7.19.7
curl	curl	7.19.6
curl	curl	7.19.5
curl	curl	7.19.4
curl	curl	7.19.3
curl	curl	7.19.2
curl	curl	7.19.1
curl	curl	7.19.0
curl	curl	7.18.2
curl	curl	7.18.1
curl	curl	7.18.0
curl	curl	7.17.1
curl	curl	7.17.0
curl	curl	7.16.4
curl	curl	7.16.3
curl	curl	7.16.2
curl	curl	7.16.1
curl	curl	7.16.0
curl	curl	7.15.5
curl	curl	7.15.4
curl	curl	7.15.3
curl	curl	7.15.2
curl	curl	7.15.1
curl	curl	7.15.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions have not been generated yet.

Hi! I’m here to help you understand CVE-2026-92389. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70