CVE-2026-86411

Published: Oct 20, 2026Modified: Oct 29, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.

Related CWEs

CWE-488

Exposure of Data Element to Wrong Session

The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

References (4)

https://curl.se/docs/CVE-2026-86411.html

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

https://curl.se/docs/CVE-2026-86411.json

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

https://hackerone.com/reports/3973190

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

https://hackerone.com/reports/3973190

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.