Information disclosure in cURL - CVE-2026-92389
Published: October 14, 2026
Vulnerability identifier: #VU155676
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-92389
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper validation of state transitions against the requested transfer direction in libcurl's TFTP state machine when handling opening server responses to download requests. A remote attacker can send a specially crafted server response that forces the client into transmit mode to disclose sensitive information.
Data is consumed from the handle's persistent CURLOPT_READDATA pointer, which may retain data from unrelated prior operations, such as an HTTP POST request executed on a reused handle. The curl command-line tool is not affected.
Affected software
cURL
How to mitigate CVE-2026-92389
Install security update from vendor's website.
cURL - update to 8.23.0