CVE-2026-92388
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via curl_easy_duphandle() copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read; alternatively, reusing the original or cloned handle while changing only CURLOPT_WRITEDATA results in type confusion.
Risk Assessment
An application may crash, suffer a heap use-after-free read, or write server data to an application-supplied pointer, potentially enabling memory corruption. The risk affects applications using FTP wildcard LIST and reusing handles.
Recommendation
Update libcurl to a patched version. Avoid reusing handles after a failed FTP wildcard LIST operation.
Other vulnerabilities in libcurl
See all- CVE-2023-38546Low
A flaw in libcurl allows an attacker to insert cookies at will into a running program if specific conditions are met. When an easy handle with cookies enabled is duplicated via curl_easy_duphandle and the source handle did not read cookies from a file, the cloned handle stores the filename as "none", potentially causing inadvertent loading of cookies from a file named "none" in the current directory.
- CVE-2017-1000254High
libcurl may read outside of a heap allocated buffer when doing FTP. A flaw in the string parser for the directory name may lead to a missing NUL byte at the end of the buffer, resulting in the potential to read data beyond the allocated memory area.
- CVE-2016-5421High
Use-after-free vulnerability in libcurl before version 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.
- CVE-2016-0755High
The ConnectionExists function in lib/url.c in libcurl before version 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request.
- CVE-2025-4947Medium
libcurl accidentally skips certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.
- CVE-2024-6874Medium
The curl_url_get() function in libcurl offers punycode conversions to and from IDN. When converting a name that is exactly 256 bytes, libcurl reads outside a stack-based buffer when built with the macidn IDN backend.
- CVE-2024-6197High
libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. It can detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte local stack buffer. Most modern malloc implementations detect this error and immediately abort.
- CVE-2025-5025Medium
libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, but fails to specify that it does not for QUIC.
- CVE-2025-5399Medium
Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS.
- CVE-2026-19931Critical
A flaw in libcurl causes it to wrongly reuse an HTTP connection established for a given hostname using Negotiate authentication, when the initial request is made with empty credentials. This can cause user B's request to be sent over user A's previously authenticated connection.
Original NVD description (English source)
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS