7 matches found
CVE-2026-92387 never-ending loop via server response omission
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle...
CVE-2026-92387
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle...
CVE-2026-92387
The libcurl library is vulnerable to a denial of service (DoS) condition where a malicious FTP, IMAP, POP3, or SMTP server can exploit the software by permanently omitting the final control-response line. This action allows the attacker to completely bypass the configured transfer timeout mechani...
CVE-2026-92387
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle...
CVE-2026-92387
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle...
curl: CVE-2026-111952: OpenSSL provider use-after-free again
Summary Since 8.23.0, libcurl caches its OpenSSL certificate store per multi handle even when CURLOPTCAPATH is set. OpenSSL loads CApath certificates lazily during verification, and they belong to the library context of the transfer that loaded them. With CURLOPTSSLENGINE that is a private...
CURL-CVE-2026-92387 never-ending loop via server response omission
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle...