TLS Misconfiguration in cURL Affecting Secure Connections

CVE-2026-4873

What is CVE-2026-4873?

A misconfiguration in cURL exists where connections requiring TLS can inadvertently reuse an existing unencrypted connection from the same pool. This means that if an initial data transfer is performed in clear text using protocols such as IMAP, SMTP, or POP3, subsequent requests to the same host might bypass TLS protections entirely, resulting in unencrypted transmission of sensitive data. This vulnerability can expose data to eavesdropping, undermining the confidentiality of information sent over what should be a secure connection.

References