Buy commercial curl support. We
help you work out your issues, debug your libcurl applications, use the API,
port to new platforms, add new features and more. With a team lead by the
curl founder Daniel himself.
[ADVISORY] curl: CVE-2026-4873: connection reuse ignores TLS requirement
- Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]
From: Daniel Stenberg via curl-library <curl-library_at_lists.haxx.se>
Date: Wed, 29 Apr 2026 08:00:52 +0200 (CEST)
connection reuse ignores TLS requirement
========================================
Project curl Security Advisory, April 29 2026
[Permalink](https://curl.se/docs/CVE-2026-4873.html)
VULNERABILITY
-------------
A vulnerability exists where a connection requiring TLS incorrectly reuses an
existing unencrypted connection from the same connection pool. If an initial
transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request
to that same host will bypass the TLS requirement and instead transmit data
unencrypted.
INFO
Date: Wed, 29 Apr 2026 08:00:52 +0200 (CEST)
connection reuse ignores TLS requirement
========================================
Project curl Security Advisory, April 29 2026
[Permalink](https://curl.se/docs/CVE-2026-4873.html)
VULNERABILITY
-------------
A vulnerability exists where a connection requiring TLS incorrectly reuses an
existing unencrypted connection from the same connection pool. If an initial
transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request
to that same host will bypass the TLS requirement and instead transmit data
unencrypted.
INFO
---- This flaw requires a rather special series of events to trigger. Such a series is unlikely to be used much in the wild. This issue only happens for transfers done using `IMAP://`, `POP3://` or `SMTP://` URL schemes. The initial transfer and the second transfer both need to be done to the same host, use the same credentials and the same URL schemes. The login and the initial transfer is done over clear-text, so the user is obviously already accepting an insecure transmission for this. This flaw still makes it worse as the second transfer is intended to be secured by TLS but is not. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-4873 to this issue. CWE-319: Cleartext Transmission of Sensitive Information Severity: Low AFFECTED VERSIONS ----------------- - Affected versions: curl 7.20.0 to and including 8.19.0 - Not affected versions: curl < 7.20.0 and >= 8.20.0 - Introduced-in: https://github.com/curl/curl/commit/ec3bb8f727405642a libcurl is used by many applications, but not always advertised as such! This bug is not considered a *C mistake*. It is not likely to have been avoided had we not been using C. This flaw also affects the curl command line tool. SOLUTION -------- curl 8.20.0 fixes this logical flaw - Fixed-in: https://github.com/curl/curl/commit/507e7be573b0a76fca597b75 RECOMMENDATIONS --------------- We suggest you take one of the following actions immediately, in order of preference: A - Upgrade to curl and libcurl 8.20.0 B - Apply the patch and rebuild libcurl C - Do not use clear-text IMAP/POP3/SMTP transfers TIMELINE --------- It was reported to the curl project on March 22nd 2026. We contacted distros_at_openwall on April 23. libcurl 8.20.0 was released on April 29th 2026, coordinated with the publication of this advisory. CREDITS ------- - Reported-by: Arkadi Vainbrand - Patched-by: Daniel Stenberg Thanks a lot! -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library Etiquette: https://curl.se/mail/etiquette.htmlReceived on 2026-04-29