🔐 CVE Alert

CVE-2026-92387

UNKNOWN 0.0

never-ending loop via server response omission

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.

Vendor curl
Product curl
Published Oct 20, 2026
Stay Ahead of the Next One

Get instant alerts for curl curl

Be the first to know when new unknown vulnerabilities affecting curl curl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

curl / curl
8.22.0 ≤ 8.22.0 8.21.0 ≤ 8.21.0 8.20.0 ≤ 8.20.0 8.19.0 ≤ 8.19.0 8.18.0 ≤ 8.18.0 8.17.0 ≤ 8.17.0 8.16.0 ≤ 8.16.0 8.15.0 ≤ 8.15.0 8.14.1 ≤ 8.14.1 8.14.0 ≤ 8.14.0 8.13.0 ≤ 8.13.0 8.12.1 ≤ 8.12.1 8.12.0 ≤ 8.12.0 8.11.1 ≤ 8.11.1 8.11.0 ≤ 8.11.0 8.10.1 ≤ 8.10.1 8.10.0 ≤ 8.10.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗
curl.se: https://curl.se/docs/CVE-2026-92387.json curl.se: https://curl.se/docs/CVE-2026-92387.html hackerone.com: https://hackerone.com/reports/4022003

Credits

Joshua Rogers (Aisle Research) Daniel Stenberg