PT-2026-113749

CVE-2026-92387

Published

2026-10-14

Updated

2026-11-03

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)

Description A malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl by permanently omitting the final control-response line. This action allows the server to completely bypass the configured transfer timeout mechanism, resulting in an indefinite block of all concurrent transfers associated with the same multi-handle.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Daniel Stenberg

Joshua Rogers

Vendors

Affected products

Weakness enumeration

CWE-835: Loop with Unreachable Exit Condition (\'Infinite Loop\')

Related identifiers