CVE-2026-92389
TFTP direction confusion
Project curl Security Advisory, October 14 2026 Permalink
VULNERABILITY
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,
prompting libcurl to consume and transmit data from the handle's persistent CURLOPT_READDATA pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.
INFO
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-92389 to this issue.
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Severity: Low
AFFECTED VERSIONS
- Affected versions: curl 7.15.0 to and including 8.22.0
- Not affected versions: curl < 7.15.0 and >= 8.23.0
- Not affected versions: curl >= 8.20.2 in the 8.20.X branch
- Not affected versions: curl >= 8.16.2 in the 8.16.X branch
- Not affected versions: curl >= 8.14.3 in the 8.14.X branch
- Introduced-in: https://github.com/curl/curl/commit/56d9624b566ac15ffb4b4
libcurl is used by many applications, but not always advertised as such!
This flaw does not affect the curl command line tool.
SOLUTION
RECOMMENDATIONS
A - Upgrade curl to version 8.23.0
B - Apply the patch to your local version
C - Use fresh easy handles for TFTP
TIMELINE
This issue was reported to the curl project on September 11, 2026.
curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.
CREDITS
- Reported-by: Joshua Rogers (Aisle Research)
- Patched-by: Daniel Stenberg
Thanks a lot!