curl libcurl: Infinite loop via omitted server response line in pingpong protocols

Summary

A libcurl flaw in the pingpong code shared by FTP, IMAP, POP3 and SMTP allows a malicious server to permanently omit the final control-response line. The client then loops indefinitely and bypasses its configured transfer timeout, blocking all concurrent transfers on the same multi-handle. The attacker must control the server the client connects to, and the attack needs the server to feed data at read speed, which makes it harder in practice.

Affected

• libcurl 8.10.0 up to and including 8.22.0 (per curl advisory)
• Not affected: curl below 8.10.0 and 8.23.0 or later
• Not affected: 8.20.2 and later in the 8.20.X branch, 8.16.2 and later in the 8.16.X branch, 8.14.3 and later in the 8.14.X branch
• The curl command line tool is not affected according to the research notes; applications linking libcurl are affected
• Distribution status differs: Ubuntu 26.04 LTS is fixed in 8.18.0-1ubuntu2.8, Ubuntu 24.04 LTS and older are not affected, Debian bookworm is not affected, Debian trixie is vulnerable with no DSA planned, Debian sid is fixed in 8.23.0-1

Fixed in

• Upstream curl 8.23.0 (fix commit 753735af87f5c30cb6f60a7)
• Ubuntu 26.04 LTS: 8.18.0-1ubuntu2.8
• Debian sid: 8.23.0-1; Debian forky: vulnerable at time of research
• Other vendors (Windows, macOS, appliances, embedded firmware): Unknown.

Workaround

• No workaround is named by the curl project. Upgrading is the only fix named.
• A configured transfer timeout must not be relied on, because the flaw bypasses it.
• Interim measure (not from a source): restrict which FTP, IMAP, POP3 and SMTP servers applications can contact, and avoid letting users supply arbitrary server URLs until patched.

Exploitation

• No evidence of exploitation in the wild found.
• No public proof of concept found.
• CISA SSVC lists Exploitation: poc, Automatable: no, Technical Impact: total.
• Reported by Joshua Rogers (Aisle Research).

Our recommendation

• Inventory where libcurl is used, including bundled copies inside applications, and ask the vendors of those applications for fixed builds.
• Upgrade system curl and libcurl to the fixed package from your distribution, or to upstream curl 8.23.0 when building from source.
• Debian 13 (trixie) has no DSA yet: track the next point release or apply a backport.
• Restrict untrusted user-supplied FTP, IMAP, POP3 and SMTP server URLs until patched.
• Re-check the NVD score once analysis is complete; the vector overstates the impact described by the curl project (rated Low).

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• curl security advisory CVE-2026-92387 curl.se
• curl JSON metadata CVE-2026-92387 curl.se
• curl 8.23.0 announcement curl.se
• OSV CURL-CVE-2026-92387 osv.dev
• Ubuntu CVE-2026-92387 ubuntu.com
• Debian security tracker CVE-2026-92387 security-tracker.debian.org
• HackerOne report 4022003 hackerone.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:33.