{"id":"CVE-2026-92387","kind":"vulnerability","aliases":["CVE-2026-92387"],"related":[],"title":"curl: malicious FTP, IMAP, POP3 or SMTP server blocks transfers indefinitely","description":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle.","summary":"A malicious FTP, IMAP, POP3 or SMTP server can omit the final control-response line so libcurl never finishes the exchange. This bypasses the configured transfer timeout and blocks all other transfers sharing the same multi-handle indefinitely.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","libcurl","package","php","python","self-hosted"],"not_affected_if":["http-only","trusted-servers-only"],"how_to_check":"- Run `curl --version` and note the libcurl version listed on the second line\n- Check whether your application uses libcurl's multi interface (curl_multi_*) with FTP, IMAP, POP3 or SMTP URLs\n- unknown","fix":"- Upgrade libcurl to a fixed release; the sources do not name the fixed version, so check the curl project advisory\n- Until patched, avoid connecting to untrusted FTP, IMAP, POP3 or SMTP servers through a shared multi-handle\n- unknown","status":"open","published_at":"2026-10-20T21:17:21+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:23+00:00","updated_at":"2026-10-25T05:04:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:04:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade libcurl to a fixed release; the sources do not name the fixed version, so check the curl project advisory\n- Until patched, avoid connecting to untrusted FTP, IMAP, POP3 or SMTP servers through a shared multi-handle\n- unknown","reach":"network","title":"curl: malicious FTP, IMAP, POP3 or SMTP server blocks transfers indefinitely","impact":"low","summary":"A malicious FTP, IMAP, POP3 or SMTP server can omit the final control-response line so libcurl never finishes the exchange. This bypasses the configured transfer timeout and blocks all other transfers sharing the same multi-handle indefinitely.","category":"package","nicknames":[],"who_cares":["libcurl","c","python","php","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Denial of service: concurrent transfers on the same handle hang indefinitely","analyst_note":"Find the affected and fixed libcurl versions in the NVD entry or the curl project security advisory for CVE-2026-92387.","how_to_check":"- Run `curl --version` and note the libcurl version listed on the second line\n- Check whether your application uses libcurl's multi interface (curl_multi_*) with FTP, IMAP, POP3 or SMTP URLs\n- unknown","needs_analyst":true,"not_affected_if":["http-only","trusted-servers-only"],"who_is_affected":"Applications that use libcurl to talk to FTP, IMAP, POP3 or SMTP servers, especially through the multi interface where one stuck transfer can stall others. Systems that only use HTTP or HTTPS through libcurl, or that only contact trusted mail and file servers, are less exposed. The sources do not say which libcurl versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000661,"input_tokens":3309,"output_tokens":661,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-92387':14A,17A 'block':9A,55B,95C 'bound':99C 'bypass':49B,88C 'c':18B 'complet':87C 'concurr':97C 'configur':51B,90C 'control':39B,72C 'control-respons':38B,71C 'curl':1A 'cve':12A,15A 'exchang':47B 'exploit':84C 'final':37B,70C 'finish':45B 'ftp':3A,28B,77C 'handl':64B,105C 'host':25B 'imap':4A,29B,78C 'indefinit':11A,65B,94C 'libcurl':19B,43B,85C 'line':41B,74C 'malici':2A,27B,76C 'mechan':93C 'multi':63B,104C 'multi-handl':62B,103C 'never':44B 'omit':35B,68C 'packag':20B 'perman':67C 'php':21B 'pop3':5A,30B,79C 'python':22B 'respons':40B,73C 'self':24B 'self-host':23B 'server':8A,33B,82C 'share':59B 'smtp':7A,32B,81C 'timeout':53B,92C 'transfer':10A,52B,58B,91C,98C","nicknames":[],"mitigations":[],"who_affected":"Applications that use libcurl to talk to FTP, IMAP, POP3 or SMTP servers, especially through the multi interface where one stuck transfer can stall others. Systems that only use HTTP or HTTPS through libcurl, or that only contact trusted mail and file servers, are less exposed. The sources do not say which libcurl versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","severity":null,"published_at":"2026-10-20T21:17:21+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}