CVE-2026-92387
never-ending loop via server response omission
Project curl Security Advisory, October 14 2026 Permalink
VULNERABILITY
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.
INFO
To keep libcurl "locked" in this loop, it requires that the server can feed the data to the client at read speed, meaning an extremely high network speed or an unusually slow client.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-92387 to this issue.
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Severity: Low
AFFECTED VERSIONS
- Affected versions: curl 8.10.0 to and including 8.22.0
- Not affected versions: curl < 8.10.0 and >= 8.23.0
- Not affected versions: curl >= 8.20.2 in the 8.20.X branch
- Not affected versions: curl >= 8.16.2 in the 8.16.X branch
- Not affected versions: curl >= 8.14.3 in the 8.14.X branch
- Introduced-in: https://github.com/curl/curl/commit/a5598b6fcb9ec6b57a77
libcurl is used by many applications, but not always advertised as such!
This flaw does not affect the curl command line tool.
SOLUTION
RECOMMENDATIONS
A - Upgrade curl to version 8.23.0
B - Apply the patch to your local version
C - Avoid using the ping-pong protocols (FTP, IMAP, SMTP, POP3)
TIMELINE
This issue was reported to the curl project on September 11, 2026.
curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.
CREDITS
- Reported-by: Joshua Rogers (Aisle Research)
- Patched-by: Daniel Stenberg
Thanks a lot!