Incomplete SASL LDAP Handshake Validation Bypass in libcurl

Executive Summary

CVE-2026-13608 is a flaw in libcurl's SASL negotiation for LDAP authentication. It allows an incomplete handshake to be misinterpreted as successful cryptographic verification. An attacker can perform a Man-in-the-Middle attack by injecting a premature response, bypassing peer validation and gaining unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system is running a vulnerable version of curl (7.82.0 through 8.21.0). Use the command: curl --version. If the output shows a version within this range, the system is affected.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability may allow attackers to bypass authentication and gain unauthorized access to systems using vulnerable curl versions with OpenLDAP SASL authentication. It specifically affects LDAP:// connections, not LDAPS:// (TLS-encrypted) connections. Attackers could intercept or manipulate data during authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily affects systems using OpenLDAP backend with unencrypted LDAP:// connections. It allows MITM attacks to bypass peer validation, which could lead to unauthorized access to sensitive data. For GDPR, this may impact data confidentiality and integrity requirements. For HIPAA, it could compromise protected health information during transmission if LDAP is used for authentication in healthcare systems.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade curl to version 8.22.0 or later. If upgrading is not possible, avoid using unencrypted LDAP:// connections. Apply any available patches from your distribution or vendor.

Useful 0 Not Useful 0