CVE-2026-86411

UNKNOWN 0.0

FTP connection reuse inherits client-certificate

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.

Vendor	curl
Product	curl
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for curl curl

Be the first to know when new unknown vulnerabilities affecting curl curl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

curl / curl

8.21.0 ≤ 8.21.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

curl.se: https://curl.se/docs/CVE-2026-86411.json curl.se: https://curl.se/docs/CVE-2026-86411.html hackerone.com: https://hackerone.com/reports/3973190

Credits

Stanislav Fort (Aisle Research) Stefan Eissing