Live › vulnerability › CVE-2026-92387
Go to dashboardA malicious FTP, IMAP, POP3 or SMTP server can omit the final control-response line so libcurl never finishes the exchange. This bypasses the configured transfer timeout and blocks all other transfers sharing the same multi-handle indefinitely.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use libcurl to talk to FTP, IMAP, POP3 or SMTP servers, especially through the multi interface where one stuck transfer can stall others. Systems that only use HTTP or HTTPS through libcurl, or that only contact trusted mail and file servers, are less exposed. The sources do not say which libcurl versions are affected.
No product ranges from the sources yet.
curl --version and note the libcurl version listed on the second lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.
This page as .md · .json · in your agent: get_signal("CVE-2026-92387")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.