Live › vulnerability › CVE-2026-92389
Go to dashboardlibcurl does not check that a TFTP server's replies match the requested transfer direction, so a malicious TFTP server can make a download request trigger an upload. The client then sends data from the handle's persistent CURLOPT_READDATA buffer, which can include leftover data from an earlier HTTP POST on a reused handle.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use libcurl to fetch TFTP URLs, especially from servers they do not control, and that reuse a handle which previously carried sensitive POST data. Systems that never use TFTP or never reuse handles for POST can likely skip it, though the sources do not confirm the exact conditions.
No product ranges from the sources yet.
curl --version and compare the libcurl version against the fixed release (unknown in the sources)tftp://) with libcurltftp:// URLs from untrusted servers until patchedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
libcurl's TFTP state machine fails to validate state transitions against the
requested transfer direction, accepting opening server responses for both
reads and writes interchangeably. A malicious TFTP server can respond to a
download request in a way that forces the client into transmit mode, prompting
libcurl to consume and transmit data from the handle's persistent
CURLOPT_READDATA pointer - including data remaining from unrelated prior
operations, such as an HTTP POST request executed on a reused handle.
This page as .md · .json · in your agent: get_signal("CVE-2026-92389")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.