Vulnerability-Lookup

CVE-2026-92387 (GCVE-0-2026-92387)

Vulnerability from cvelistv5 – Published: 2026-10-20 20:19 – Updated: 2026-10-20 20:19

Title

never-ending loop via server response omission

Summary

By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.

Severity

No CVSS data available.

CWE

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

curl CNA under the redhat root

CNA scorecard D 46/100 over 59 records in the last 180 days details

References

3 references

URL	Tags
https://curl.se/docs/CVE-2026-92387.json
https://curl.se/docs/CVE-2026-92387.html
https://hackerone.com/reports/4022003

Impacted products

1 product

Vendor	Product	Version	CPE status
curl	curl	Affected: 8.22.0 , ≤ 8.22.0 (semver) Affected: 8.21.0 , ≤ 8.21.0 (semver) Affected: 8.20.0 , ≤ 8.20.0 (semver) Affected: 8.19.0 , ≤ 8.19.0 (semver) Affected: 8.18.0 , ≤ 8.18.0 (semver) Affected: 8.17.0 , ≤ 8.17.0 (semver) Affected: 8.16.0 , ≤ 8.16.0 (semver) Affected: 8.15.0 , ≤ 8.15.0 (semver) Affected: 8.14.1 , ≤ 8.14.1 (semver) Affected: 8.14.0 , ≤ 8.14.0 (semver) Affected: 8.13.0 , ≤ 8.13.0 (semver) Affected: 8.12.1 , ≤ 8.12.1 (semver) Affected: 8.12.0 , ≤ 8.12.0 (semver) Affected: 8.11.1 , ≤ 8.11.1 (semver) Affected: 8.11.0 , ≤ 8.11.0 (semver) Affected: 8.10.1 , ≤ 8.10.1 (semver) Affected: 8.10.0 , ≤ 8.10.0 (semver)	guessed

Credits

Joshua Rogers (Aisle Research) Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThanOrEqual": "8.22.0",
              "status": "affected",
              "version": "8.22.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.21.0",
              "status": "affected",
              "version": "8.21.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.20.0",
              "status": "affected",
              "version": "8.20.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.19.0",
              "status": "affected",
              "version": "8.19.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.18.0",
              "status": "affected",
              "version": "8.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.17.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.16.0",
              "status": "affected",
              "version": "8.16.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.15.0",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.1",
              "status": "affected",
              "version": "8.14.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.0",
              "status": "affected",
              "version": "8.14.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.13.0",
              "status": "affected",
              "version": "8.13.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.1",
              "status": "affected",
              "version": "8.12.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.0",
              "status": "affected",
              "version": "8.12.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.1",
              "status": "affected",
              "version": "8.11.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.0",
              "status": "affected",
              "version": "8.11.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.1",
              "status": "affected",
              "version": "8.10.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.0",
              "status": "affected",
              "version": "8.10.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Joshua Rogers (Aisle Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T20:19:14.672Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "name": "json",
          "url": "https://curl.se/docs/CVE-2026-92387.json"
        },
        {
          "name": "www",
          "url": "https://curl.se/docs/CVE-2026-92387.html"
        },
        {
          "name": "issue",
          "url": "https://hackerone.com/reports/4022003"
        }
      ],
      "title": "never-ending loop via server response omission"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-92387",
    "datePublished": "2026-10-20T20:19:14.672Z",
    "dateReserved": "2026-09-16T08:12:45.613Z",
    "dateUpdated": "2026-10-20T20:19:14.672Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "curl",
                "vendor": "curl",
                "versions": [
                  {
                    "lessThanOrEqual": "8.22.0",
                    "status": "affected",
                    "version": "8.22.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.21.0",
                    "status": "affected",
                    "version": "8.21.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.20.0",
                    "status": "affected",
                    "version": "8.20.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.19.0",
                    "status": "affected",
                    "version": "8.19.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.18.0",
                    "status": "affected",
                    "version": "8.18.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.17.0",
                    "status": "affected",
                    "version": "8.17.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.16.0",
                    "status": "affected",
                    "version": "8.16.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.15.0",
                    "status": "affected",
                    "version": "8.15.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.14.1",
                    "status": "affected",
                    "version": "8.14.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.14.0",
                    "status": "affected",
                    "version": "8.14.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.13.0",
                    "status": "affected",
                    "version": "8.13.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.12.1",
                    "status": "affected",
                    "version": "8.12.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.12.0",
                    "status": "affected",
                    "version": "8.12.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.11.1",
                    "status": "affected",
                    "version": "8.11.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.11.0",
                    "status": "affected",
                    "version": "8.11.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.10.1",
                    "status": "affected",
                    "version": "8.10.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "8.10.0",
                    "status": "affected",
                    "version": "8.10.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."
          }
        ],
        "id": "CVE-2026-92387",
        "lastModified": "2026-10-20T21:17:21.133",
        "metrics": {},
        "published": "2026-10-20T21:17:21.133",
        "references": [
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "url": "https://curl.se/docs/CVE-2026-92387.html"
          },
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "url": "https://curl.se/docs/CVE-2026-92387.json"
          },
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "url": "https://hackerone.com/reports/4022003"
          }
        ],
        "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "vulnStatus": "Received"
      }
    }
  }
}

CERTFR-2026-AVI-1307

Vulnerability from certfr_avis - Published: 2026-10-14 - Updated: 2026-10-14

De multiples vulnérabilités ont été découvertes dans Curl. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Curl	cURL et libcurl	Curl versions antérieures à 8.23.0

References

Title

Publication Time

Tags

Bulletin de sécurité Curl CVE-2026-86412	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-107928	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92388	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92386	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86411	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-94265	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87862	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86410	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-107929	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92387	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87864	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87865	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86414	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92392	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87866	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92389	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86409	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92391	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86413	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-86415	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-94266	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87863	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-87861	2026-10-14	vendor-advisory
Bulletin de sécurité Curl CVE-2026-92390	2026-10-14	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Curl versions ant\u00e9rieures \u00e0 8.23.0",
      "product": {
        "name": "cURL et libcurl",
        "vendor": {
          "name": "Curl",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-94265",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94265"
    },
    {
      "name": "CVE-2026-87863",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87863"
    },
    {
      "name": "CVE-2026-107928",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107928"
    },
    {
      "name": "CVE-2026-86414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86414"
    },
    {
      "name": "CVE-2026-86411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86411"
    },
    {
      "name": "CVE-2026-87864",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87864"
    },
    {
      "name": "CVE-2020-8177",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-8177"
    },
    {
      "name": "CVE-2026-92392",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92392"
    },
    {
      "name": "CVE-2026-86413",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86413"
    },
    {
      "name": "CVE-2026-107929",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107929"
    },
    {
      "name": "CVE-2026-92389",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92389"
    },
    {
      "name": "CVE-2026-87861",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87861"
    },
    {
      "name": "CVE-2026-92386",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92386"
    },
    {
      "name": "CVE-2026-92387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92387"
    },
    {
      "name": "CVE-2026-12064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12064"
    },
    {
      "name": "CVE-2026-92391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92391"
    },
    {
      "name": "CVE-2026-86410",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86410"
    },
    {
      "name": "CVE-2026-86415",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86415"
    },
    {
      "name": "CVE-2026-87865",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87865"
    },
    {
      "name": "CVE-2026-87862",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87862"
    },
    {
      "name": "CVE-2026-94266",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94266"
    },
    {
      "name": "CVE-2026-92388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92388"
    },
    {
      "name": "CVE-2026-86412",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86412"
    },
    {
      "name": "CVE-2026-87866",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87866"
    },
    {
      "name": "CVE-2026-92390",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92390"
    },
    {
      "name": "CVE-2026-86409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86409"
    }
  ],
  "initial_release_date": "2026-10-14T00:00:00",
  "last_revision_date": "2026-10-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1307",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Curl. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Curl",
  "vendor_advisories": [
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86412",
      "url": "https://curl.se/docs/CVE-2026-86412.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-107928",
      "url": "https://curl.se/docs/CVE-2026-107928.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92388",
      "url": "https://curl.se/docs/CVE-2026-92388.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92386",
      "url": "https://curl.se/docs/CVE-2026-92386.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86411",
      "url": "https://curl.se/docs/CVE-2026-86411.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-94265",
      "url": "https://curl.se/docs/CVE-2026-94265.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87862",
      "url": "https://curl.se/docs/CVE-2026-87862.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86410",
      "url": "https://curl.se/docs/CVE-2026-86410.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-107929",
      "url": "https://curl.se/docs/CVE-2026-107929.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92387",
      "url": "https://curl.se/docs/CVE-2026-92387.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87864",
      "url": "https://curl.se/docs/CVE-2026-87864.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87865",
      "url": "https://curl.se/docs/CVE-2026-87865.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86414",
      "url": "https://curl.se/docs/CVE-2026-86414.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92392",
      "url": "https://curl.se/docs/CVE-2026-92392.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87866",
      "url": "https://curl.se/docs/CVE-2026-87866.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92389",
      "url": "https://curl.se/docs/CVE-2026-92389.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86409",
      "url": "https://curl.se/docs/CVE-2026-86409.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92391",
      "url": "https://curl.se/docs/CVE-2026-92391.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86413",
      "url": "https://curl.se/docs/CVE-2026-86413.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-86415",
      "url": "https://curl.se/docs/CVE-2026-86415.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-94266",
      "url": "https://curl.se/docs/CVE-2026-94266.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87863",
      "url": "https://curl.se/docs/CVE-2026-87863.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-87861",
      "url": "https://curl.se/docs/CVE-2026-87861.html"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2026-92390",
      "url": "https://curl.se/docs/CVE-2026-92390.html"
    }
  ]
}

FKIE_CVE-2026-92387

Vulnerability from fkie_nvd - Published: 2026-10-20 21:17 - Updated: 2026-10-20 21:17

Severity

Summary

References

	URL	Tags
	2499f714-1537-4658-8207-48ae4bb9eae9	https://curl.se/docs/CVE-2026-92387.html
	2499f714-1537-4658-8207-48ae4bb9eae9	https://curl.se/docs/CVE-2026-92387.json
	2499f714-1537-4658-8207-48ae4bb9eae9	https://hackerone.com/reports/4022003

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThanOrEqual": "8.22.0",
              "status": "affected",
              "version": "8.22.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.21.0",
              "status": "affected",
              "version": "8.21.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.20.0",
              "status": "affected",
              "version": "8.20.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.19.0",
              "status": "affected",
              "version": "8.19.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.18.0",
              "status": "affected",
              "version": "8.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.17.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.16.0",
              "status": "affected",
              "version": "8.16.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.15.0",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.1",
              "status": "affected",
              "version": "8.14.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.0",
              "status": "affected",
              "version": "8.14.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.13.0",
              "status": "affected",
              "version": "8.13.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.1",
              "status": "affected",
              "version": "8.12.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.0",
              "status": "affected",
              "version": "8.12.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.1",
              "status": "affected",
              "version": "8.11.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.0",
              "status": "affected",
              "version": "8.11.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.1",
              "status": "affected",
              "version": "8.10.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.0",
              "status": "affected",
              "version": "8.10.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."
    }
  ],
  "id": "CVE-2026-92387",
  "lastModified": "2026-10-20T21:17:21.133",
  "metrics": {},
  "published": "2026-10-20T21:17:21.133",
  "references": [
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "url": "https://curl.se/docs/CVE-2026-92387.html"
    },
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "url": "https://curl.se/docs/CVE-2026-92387.json"
    },
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "url": "https://hackerone.com/reports/4022003"
    }
  ],
  "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
  "vulnStatus": "Received"
}

GHSA-HQ6C-HPX5-V35C

Vulnerability from github – Published: 2026-10-20 21:31 – Updated: 2026-10-20 21:31

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-92387"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-20T21:17:21Z",
    "severity": null
  },
  "details": "By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle.",
  "id": "GHSA-hq6c-hpx5-v35c",
  "modified": "2026-10-20T21:31:08Z",
  "published": "2026-10-20T21:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92387"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/4022003"
    },
    {
      "type": "WEB",
      "url": "https://curl.se/docs/CVE-2026-92387.html"
    },
    {
      "type": "WEB",
      "url": "https://curl.se/docs/CVE-2026-92387.json"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

OPENSUSE-SU-2026:12150-1

Vulnerability from csaf_opensuse - Published: 2026-10-16 00:00 - Updated: 2026-10-17 09:17

Summary

curl-8.23.0-1.1 on GA media

Severity

Moderate

Scope

23 vulnerabilities in this advisory, including CVE-2026-92387.

CVE-2026-92387

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Recommended: 36 products

Open the full advisory

RHSA-2026:82895

Vulnerability from csaf_redhat - Published: 2026-10-14 11:39 - Updated: 2026-10-17 12:55

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Scope

26 vulnerabilities in this advisory, including CVE-2026-92387.

CVE-2026-92387

A flaw was found in curl. When communicating with a malicious server using protocols such as FTP, IMAP, POP3, or SMTP, the server can trigger an infinite loop by continuously transmitting data while omitting the final control response line. This behavior bypasses configured transfer timeouts, indefinitely blocking concurrent transfers and resulting in a Denial of Service (DoS).

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Fixed: 13 products

https://access.redhat.com/errata/RHSA-2026:82895

Open the full advisory

UBUNTU-CVE-2026-92387 (CVE-2026-92387)

Vulnerability from osv_ubuntu – Published: 2026-10-14 06:00 – Updated: 2026-10-19 20:36 – Source website

Details

Severity

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2026-92387	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-92387	REPORT
	https://curl.se/docs/CVE-2026-92387.html	REPORT
	https://ubuntu.com/security/notices/USN-8927-1	ADVISORY
	https://ubuntu.com/security/notices/USN-8927-2	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "8.20.0-2ubuntu11.1"
          },
          {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.20.0-2ubuntu11.1"
          },
          {
            "binary_name": "libcurl4t64",
            "binary_version": "8.20.0-2ubuntu11.1"
          }
        ],
        "priority_reason": "Upstream defined this as low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@8.20.0-2ubuntu11.1?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.20.0-2ubuntu11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.18.0-1ubuntu2",
        "8.20.0-2ubuntu1",
        "8.20.0-2ubuntu3",
        "8.20.0-2ubuntu10",
        "8.20.0-2ubuntu11"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "8.18.0-1ubuntu2.8"
          },
          {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.18.0-1ubuntu2.8"
          },
          {
            "binary_name": "libcurl4t64",
            "binary_version": "8.18.0-1ubuntu2.8"
          }
        ],
        "priority_reason": "Upstream defined this as low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.18.0-1ubuntu2.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.14.1-2ubuntu1",
        "8.17.0-1ubuntu1",
        "8.18.0-1ubuntu1",
        "8.18.0-1ubuntu2",
        "8.18.0-1ubuntu2.1",
        "8.18.0-1ubuntu2.2",
        "8.18.0-1ubuntu2.3",
        "8.18.0-1ubuntu2.4",
        "8.18.0-1ubuntu2.5",
        "8.18.0-1ubuntu2.7"
      ]
    }
  ],
  "aliases": [],
  "details": "By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.",
  "id": "UBUNTU-CVE-2026-92387",
  "modified": "2026-10-19T20:36:26Z",
  "published": "2026-10-14T06:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-92387"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92387"
    },
    {
      "type": "REPORT",
      "url": "https://curl.se/docs/CVE-2026-92387.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8927-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8927-2"
    }
  ],
  "related": [
    "USN-8927-1",
    "USN-8927-2"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-92387"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-92387 (GCVE-0-2026-92387)

CERTFR-2026-AVI-1307

Solutions

FKIE_CVE-2026-92387

GHSA-HQ6C-HPX5-V35C

OPENSUSE-SU-2026:12150-1

RHSA-2026:82895

UBUNTU-CVE-2026-92387 (CVE-2026-92387)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour