libcurl: Use-after-free and type confusion in FTP wildcard transfers
Summary
A failed FTP wildcard LIST operation in libcurl leaves the write callback and write data in an invalid state, and cloning the handle copies that state. Reusing or cloning such a handle can cause a crash, a heap use-after-free read, or the parser writing server response bytes into application memory. The flaw requires CURLOPT_FTP_WILDCARD to be enabled and affects applications that use libcurl, not the curl command line tool. The vendor rates it Low; the NVD record lists CVSS 9.1 (Awaiting Analysis) and the CISA SSVC lists exploitation as poc.
Affected
- curl 7.21.0 up to and including 8.22.0
- Not affected: curl 8.23.0 and later
- Not affected: curl 8.20.2 and later in the 8.20.X branch
- Not affected: curl 8.16.2 and later in the 8.16.X branch
- Not affected: curl 8.14.3 and later in the 8.14.X branch
- Not affected: curl versions before 7.21.0
- The curl command line tool is not affected
Fixed in
- Upgrade to curl 8.23.0 (released October 14, 2026)
- Or apply the upstream patches: ba8f8a7f27a5c5e19e4ef212 and b85acacec9b38442741bb019bc9
- Distributor status varies: Ubuntu 26.04 LTS fixed in 8.18.0-1ubuntu2.8, Debian sid fixed in 8.23.0-1, Alpine fixed in 8.23.0-r0. Unknown for RHEL, SUSE and Windows-bundled builds.
Workaround
- Avoid FTP wildcard operations (CURLOPT_FTP_WILDCARD) where possible
- Never reuse or clone easy handles for or after FTP wildcard matches
- No vendor-approved alternative mitigation is known
Exploitation
- The CISA SSVC assessment lists exploitation as poc and automatable as yes
- No CISA KEV listing, in-the-wild exploitation report or public PoC code was found in the research
- Authentication requirements are not stated in the advisory
Our recommendation
- Identify applications and third-party software (backup, ERP, monitoring tools) that embed libcurl and use FTP wildcard features
- Upgrade libcurl to 8.23.0 or apply the vendor patch; rebuild statically linked applications
- Update Debian bookworm/trixie and Ubuntu 24.04/22.04 hosts once distribution fixes are available
- Until patched, stop FTP wildcard use or stop reusing those handles
- Monitor vendor and distributor advisories for updates
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vendor advisory (curl) curl.se
- Machine-readable advisory (curl JSON) curl.se
- Original report (HackerOne) hackerone.com
- Release announcement (curl mailing list) curl.se
- Ubuntu security notice ubuntu.com
- Debian security tracker security-tracker.debian.org
- OSV (curl) osv.dev
- OSV (Alpine) osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:54.
Original description (NVD)
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.