Infinite loop in cURL - CVE-2026-92387

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a loop with an unreachable exit condition in libcurl's FTP, IMAP, POP3, and SMTP control-response handling when processing server responses. A remote attacker can permanently omit the final control-response line to cause a denial of service by bypassing configured transfer timeouts and indefinitely blocking all concurrent transfers bound to the same multi-handle.

Sustaining the loop requires the server to feed data at the client's read speed, requiring a very high network speed or an unusually slow client. The curl command-line tool is not affected.

Affected software

How to mitigate CVE-2026-92387

External References

• https://curl.se/docs/CVE-2026-92387.html
• https://github.com/curl/curl/commit/a5598b6fcb9ec6b57a77

Related Security Bulletins

• Multiple vulnerabilities in cURL