curl: CVE-2026-92387: never-ending loop via server response omission

Hi all, I found a way to make a malicious FTP, IMAP, POP3, or SMTP server defeat libcurl's own transfer timeout entirely and, worse, freeze every other transfer sharing the same multi handle. All it takes is never sending a final control-response line. The bug Curlppstatemach checks the response...