libcurl: TFTP direction confusion can send data from a reused handle
Summary
libcurl does not check that the server's TFTP response matches the requested transfer direction. A malicious TFTP server can answer a download request so that the client switches to upload mode and transmits data from the handle's CURLOPT_READDATA pointer, which may include data from earlier operations such as an HTTP POST on a reused handle. The vendor rates the issue Low and the curl command line tool is not affected; the attack requires the application to fetch from an attacker-chosen TFTP server.
Affected
- libcurl 7.15.0 through 8.22.0 (per vendor advisory)
- Branch releases before 8.14.3, 8.16.2 and 8.20.2 are affected
- The curl command line tool is not affected
- Distribution packages vary; verify against your distribution's advisory
Fixed in
- curl 8.23.0 (fix commit 63dd390fab905a239a97e270)
- Branch releases 8.14.3, 8.16.2 and 8.20.2
Workaround
- Use fresh easy handles for TFTP transfers (vendor recommendation)
- Apply the vendor patch to a local build
- Avoid TFTP transfers to untrusted servers (own recommendation, not from the vendor)
Exploitation
- No evidence of exploitation in the wild found; not listed in CISA KEV
- No public proof of concept found
- CISA SSVC: exploitation poc, automatable no, technical impact total
- NVD scoring is still pending; the CVSS 8.1 value is not confirmed by the vendor
Our recommendation
- Update libcurl to 8.23.0 or the fixed branch release, or install your distribution's fixed package
- Check servers, scripts and applications for libcurl, including statically or vendored bundled copies, and update or rebuild them
- Until patched, use fresh easy handles for TFTP and avoid TFTP to untrusted servers
- Prioritise this according to exposure: the risk is low for most SMEs
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- curl security advisory CVE-2026-92389 curl.se
- curl JSON metadata CVE-2026-92389 curl.se
- OSV entry CURL-CVE-2026-92389 osv.dev
- curl release announcement lib-2026-10 curl.se
- Debian security tracker CVE-2026-92389 security-tracker.debian.org
- Ubuntu curl vulnerability fixes ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:33.
Original description (NVD)
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.