CURL-CVE-2026-92387

vendorUSosv

never-ending loop via server response omission

view advisory published 2026-10-14Licence: per source

By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2026-92387US——
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mecha…
scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan