CVE-2026-86411

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1

Description An ftp:// transfer configured with CURLUSESSL NONE may reuse a pooled FTP control connection previously upgraded with STARTTLS and authenticated via a client certificate. Because the subsequent handle does not initiate a new TLS handshake or FTP login, the server continues to authorize the session using the identity of the first handle's certificate.

Recommendations Update to version 8.23.0-1.1.