CVE-2026-92389
Received Received - Intake

TFTP State Confusion in libcurl Leading to Data Leak

Publication date: 2026-10-20

Last updated on: 2026-10-30

Assigner: curl

Description
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-30
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-08
NVD
CVE-2026-92389

Affected Vendors & Products

Showing 159 associated CPEs
Vendor Product Version / Range
curl curl 8.22.0
curl curl 8.21.0
curl curl 8.20.0
curl curl 8.19.0
curl curl 8.18.0
curl curl 8.17.0
curl curl 8.16.0
curl curl 8.15.0
curl curl 8.14.1
curl curl 8.14.0
curl curl 8.13.0
curl curl 8.12.1
curl curl 8.12.0
curl curl 8.11.1
curl curl 8.11.0
curl curl 8.10.1
curl curl 8.10.0
curl curl 8.9.1
curl curl 8.9.0
curl curl 8.8.0
curl curl 8.7.1
curl curl 8.7.0
curl curl 8.6.0
curl curl 8.5.0
curl curl 8.4.0
curl curl 8.3.0
curl curl 8.2.1
curl curl 8.2.0
curl curl 8.1.2
curl curl 8.1.1
curl curl 8.1.0
curl curl 8.0.1
curl curl 8.0.0
curl curl 7.88.1
curl curl 7.88.0
curl curl 7.87.0
curl curl 7.86.0
curl curl 7.85.0
curl curl 7.84.0
curl curl 7.83.1
curl curl 7.83.0
curl curl 7.82.0
curl curl 7.81.0
curl curl 7.80.0
curl curl 7.79.1
curl curl 7.79.0
curl curl 7.78.0
curl curl 7.77.0
curl curl 7.76.1
curl curl 7.76.0
curl curl 7.75.0
curl curl 7.74.0
curl curl 7.73.0
curl curl 7.72.0
curl curl 7.71.1
curl curl 7.71.0
curl curl 7.70.0
curl curl 7.69.1
curl curl 7.69.0
curl curl 7.68.0
curl curl 7.67.0
curl curl 7.66.0
curl curl 7.65.3
curl curl 7.65.2
curl curl 7.65.1
curl curl 7.65.0
curl curl 7.64.1
curl curl 7.64.0
curl curl 7.63.0
curl curl 7.62.0
curl curl 7.61.1
curl curl 7.61.0
curl curl 7.60.0
curl curl 7.59.0
curl curl 7.58.0
curl curl 7.57.0
curl curl 7.56.1
curl curl 7.56.0
curl curl 7.55.1
curl curl 7.55.0
curl curl 7.54.1
curl curl 7.54.0
curl curl 7.53.1
curl curl 7.53.0
curl curl 7.52.1
curl curl 7.52.0
curl curl 7.51.0
curl curl 7.50.3
curl curl 7.50.2
curl curl 7.50.1
curl curl 7.50.0
curl curl 7.49.1
curl curl 7.49.0
curl curl 7.48.0
curl curl 7.47.1
curl curl 7.47.0
curl curl 7.46.0
curl curl 7.45.0
curl curl 7.44.0
curl curl 7.43.0
curl curl 7.42.1
curl curl 7.42.0
curl curl 7.41.0
curl curl 7.40.0
curl curl 7.39.0
curl curl 7.38.0
curl curl 7.37.1
curl curl 7.37.0
curl curl 7.36.0
curl curl 7.35.0
curl curl 7.34.0
curl curl 7.33.0
curl curl 7.32.0
curl curl 7.31.0
curl curl 7.30.0
curl curl 7.29.0
curl curl 7.28.1
curl curl 7.28.0
curl curl 7.27.0
curl curl 7.26.0
curl curl 7.25.0
curl curl 7.24.0
curl curl 7.23.1
curl curl 7.23.0
curl curl 7.22.0
curl curl 7.21.7
curl curl 7.21.6
curl curl 7.21.5
curl curl 7.21.4
curl curl 7.21.3
curl curl 7.21.2
curl curl 7.21.1
curl curl 7.21.0
curl curl 7.20.1
curl curl 7.20.0
curl curl 7.19.7
curl curl 7.19.6
curl curl 7.19.5
curl curl 7.19.4
curl curl 7.19.3
curl curl 7.19.2
curl curl 7.19.1
curl curl 7.19.0
curl curl 7.18.2
curl curl 7.18.1
curl curl 7.18.0
curl curl 7.17.1
curl curl 7.17.0
curl curl 7.16.4
curl curl 7.16.3
curl curl 7.16.2
curl curl 7.16.1
curl curl 7.16.0
curl curl 7.15.5
curl curl 7.15.4
curl curl 7.15.3
curl curl 7.15.2
curl curl 7.15.1
curl curl 7.15.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction. A malicious TFTP server can force the client into transmit mode, causing libcurl to send data from the handle's persistent CURLOPT_READDATA pointer, including leftover data from prior operations like HTTP POST requests on reused handles.

Detection Guidance

This vulnerability involves libcurl's TFTP state machine incorrectly handling transfer directions. Detection requires monitoring for unexpected TFTP server responses or data exfiltration attempts. Check logs for unusual TFTP traffic patterns or data transmission from client handles. Use network monitoring tools like tcpdump or Wireshark to inspect TFTP packets for malformed state transitions.

Impact Analysis

This vulnerability could allow an attacker to exfiltrate sensitive data from your system if you use libcurl to interact with a malicious TFTP server. Data from previous operations, such as HTTP POST requests, may be transmitted without your knowledge.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, potentially violating GDPR's data protection principles or HIPAA's confidentiality requirements if sensitive data is transmitted without consent.

Mitigation Strategies

Immediately update libcurl to the latest patched version. Disable TFTP support in applications using libcurl if not required. Monitor network traffic for suspicious TFTP activity. Avoid reusing libcurl handles across different protocols to prevent data leakage. Apply firewall rules to restrict TFTP traffic to trusted servers only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92389. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...