CVE-2026-86411
FTP connection reuse inherits client-certificate
Project curl Security Advisory, October 14 2026 Permalink
VULNERABILITY
An ftp:// transfer configured with CURLUSESSL_NONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP
login, so the server continues to authorize it under the first handle's certificate identity.
INFO
FTP transfers using client certificates are rare.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-86411 to this issue.
CWE-488: Exposure of Data Element to Wrong Session
Severity: Low
AFFECTED VERSIONS
- Affected version: curl 8.21.0
- Not affected versions: curl < 8.21.0 and >= 8.22.0
- Introduced-in: https://github.com/curl/curl/commit/4ff212f8ed328fb95261e11a
libcurl is used by many applications, but not always advertised as such!
This flaw also affects the curl command line tool.
SOLUTION
RECOMMENDATIONS
A - Upgrade curl to version 8.22.0
B - Apply the patch to your local version
C - Do not use client certificates for FTP
TIMELINE
This issue was reported to the curl project on August 27, 2026.
curl 8.22.0 was released on September 2, 2026. This advisory was published on October 14, 2026.
CREDITS
- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Stefan Eissing
Thanks a lot!