CVE Feed

    Dashboard / CVE / CVE-2026-86411

    CVE-2026-86411

    An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.

    Published:Oct 14, 2026
    Last Modified:Oct 29, 2026
    EPS:Oct 20, 2026
    EPSS Score:0.00433
    CVSS Score:9.1

    Affected Products

    Vendor
    Curl
    Product
    Curl

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-86410 (CVSS 8.1) — A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting …
    CVE-2026-94266 (CVSS 7.5) — libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing…
    CVE-2026-87862 (CVSS 8.1) — Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child.…
    CVE-2026-92391 (CVSS 7.5) — A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl dur…
    CVE-2026-86409 (CVSS 8.1) — Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and do…
    CVE-2026-94265 (CVSS 9.1) — When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might er…
    CVE-2026-86415 (CVSS 7.5) — libcurl's connection cache match function never considers the automatic client certificate option, so a cached…
    CVE-2026-87861 (CVSS 9.1) — When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connectio…
    CVE-2026-92387 (CVSS 8.1) — By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can explo…
    CVE-2026-92390 (CVSS 7.5) — When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protect…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High