{
  "schema_version": "1.5.0",
  "id": "CURL-CVE-2026-86411",
  "aliases": [
    "CVE-2026-86411"
  ],
  "summary": "FTP connection reuse inherits client-certificate",
  "modified": "2026-09-09T11:42:42.00Z",
  "database_specific": {
    "package": "curl",
    "affects": "both",
    "URL": "https://curl.se/docs/CVE-2026-86411.json",
    "www": "https://curl.se/docs/CVE-2026-86411.html",
    "issue": "https://hackerone.com/reports/3973190",
    "CWE": {
      "id": "CWE-488",
      "desc": "Exposure of Data Element to Wrong Session"
    },
    "last_affected": "8.21.0",
    "severity": "Low"
  },
  "published": "2026-10-14T08:00:00.00Z",
  "affected": [
    {
      "ranges": [
        {
           "type": "SEMVER",
           "events": [
             {"introduced": "8.21.0"},
             {"fixed": "8.22.0"}
           ]
        },
        {
           "type": "GIT",
           "repo": "https://github.com/curl/curl.git",
           "events": [
             {"introduced": "4ff212f8ed328fb95261e11add8f4d2f0616895a"},
             {"fixed": "72352daba01ba8072b6c1c0254cb77860ed1ab06"}
           ]
        }
      ],
      "versions": [
        "8.21.0"
      ]
    }
  ],
  "credits": [
    {
      "name": "Stanislav Fort (Aisle Research)",
      "type": "FINDER"
    },
    {
      "name": "Stefan Eissing",
      "type": "REMEDIATION_DEVELOPER"
    }
  ],
  "details": "An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity."
}