CVE-2026-92387
Fixed in a distro release EPSS <1%
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.
Products: curl
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.23 | curl | 8.23.0-r0 |
| Alpine 3.24 | curl | 8.23.0-r0 |
| Debian 13 | curl | no fix |
| Debian 14 | curl | no fix |
| Red Hat hummingbird 1 | curl | 0:8.23.0-0.1.hum1 |
| Red Hat hummingbird 1 | libcurl | 0:8.23.0-0.1.hum1 |
| Red Hat hummingbird 1 | libcurl-devel | 0:8.23.0-0.1.hum1 |
| Red Hat hummingbird 1 | libcurl-minimal | 0:8.23.0-0.1.hum1 |
| Ubuntu 26.04 LTS | curl | 8.18.0-1ubuntu2.8 |
| Ubuntu 26.10 | curl | 8.20.0-2ubuntu11.1 |
| openSUSE Tumbleweed | curl | 8.23.0-1.1 |