{"id":"CVE-2026-92389","kind":"vulnerability","aliases":["CVE-2026-92389"],"related":[],"title":"libcurl: TFTP state flaw can leak POST upload data to malicious servers","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle.","summary":"libcurl does not check that a TFTP server's replies match the requested transfer direction, so a malicious TFTP server can make a download request trigger an upload. The client then sends data from the handle's persistent CURLOPT_READDATA buffer, which can include leftover data from an earlier HTTP POST on a reused handle.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","libcurl","runtime","self-hosted","tftp"],"not_affected_if":["no-handle-reuse","no-tftp-use"],"how_to_check":"- Run `curl --version` and compare the libcurl version against the fixed release (unknown in the sources)\n- Check whether application code uses TFTP URLs (`tftp://`) with libcurl\n- Check whether handles are reused across requests with CURLOPT_READDATA set","fix":"- Upgrade libcurl to a patched release (fixed version unknown in the sources)\n- Avoid fetching `tftp://` URLs from untrusted servers until patched\n- Do not reuse a handle across unrelated uploads and downloads","status":"open","published_at":"2026-10-20T21:17:21+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:21+00:00","updated_at":"2026-10-25T05:04:21+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:04:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade libcurl to a patched release (fixed version unknown in the sources)\n- Avoid fetching `tftp://` URLs from untrusted servers until patched\n- Do not reuse a handle across unrelated uploads and downloads","reach":"network","title":"libcurl: TFTP state flaw can leak POST upload data to malicious servers","impact":"medium","summary":"libcurl does not check that a TFTP server's replies match the requested transfer direction, so a malicious TFTP server can make a download request trigger an upload. The client then sends data from the handle's persistent CURLOPT_READDATA buffer, which can include leftover data from an earlier HTTP POST on a reused handle.","category":"runtime","nicknames":[],"who_cares":["libcurl","tftp","c","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Sensitive data from prior operations is sent to a malicious TFTP server","analyst_note":"Find the fixed libcurl version and affected version range from the NVD entry or curl's security advisory.","how_to_check":"- Run `curl --version` and compare the libcurl version against the fixed release (unknown in the sources)\n- Check whether application code uses TFTP URLs (`tftp://`) with libcurl\n- Check whether handles are reused across requests with CURLOPT_READDATA set","needs_analyst":true,"not_affected_if":["no-tftp-use","no-handle-reuse"],"who_is_affected":"Applications that use libcurl to fetch TFTP URLs, especially from servers they do not control, and that reuse a handle which previously carried sensitive POST data. Systems that never use TFTP or never reuse handles for POST can likely skip it, though the sources do not confirm the exact conditions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000661,"input_tokens":3370,"output_tokens":647,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-92389':15A,18A 'accept':96C 'buffer':66B 'c':19B 'check':29B 'client':55B,122C 'consum':129C 'curlopt':64B,138C 'cve':13A,16A 'data':9A,58B,71B,132C,142C 'direct':40B,95C 'download':49B,114C 'earlier':74B 'execut':154C 'fail':86C 'flaw':4A 'forc':120C 'handl':61B,80B,135C,158C 'host':24B 'http':75B,151C 'includ':69B,141C 'interchang':105C 'leak':6A 'leftov':70B 'libcurl':1A,20B,26B,81C,127C 'machin':85C 'make':47B 'malici':11A,43B,107C 'match':36B 'mode':125C 'open':97C 'oper':147C 'persist':63B,137C 'pointer':140C 'post':7A,76B,152C 'prior':146C 'prompt':126C 'read':102C 'readdata':65B,139C 'remain':143C 'repli':35B 'request':38B,50B,93C,115C,153C 'respond':111C 'respons':99C 'reus':79B,157C 'runtim':21B 'self':23B 'self-host':22B 'send':57B 'server':12A,33B,45B,98C,109C 'state':3A,84C,89C 'tftp':2A,25B,32B,44B,83C,108C 'transfer':39B,94C 'transit':90C 'transmit':124C,131C 'trigger':51B 'unrel':145C 'upload':8A,53B 'valid':88C 'way':118C 'write':104C","nicknames":[],"mitigations":[],"who_affected":"Applications that use libcurl to fetch TFTP URLs, especially from servers they do not control, and that reuse a handle which previously carried sensitive POST data. Systems that never use TFTP or never reuse handles for POST can likely skip it, though the sources do not confirm the exact conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92389","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","severity":null,"published_at":"2026-10-20T21:17:21+00:00","modified_at":"2026-10-22T16:57:53+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}