FTP Control Connection Vulnerability in cURL
CVE-2026-86411
Currently unrated
What is CVE-2026-86411?
A vulnerability exists in cURL's handling of FTP connections where an FTP transfer configured with CURLUSESSL_NONE may incorrectly reuse a pooled FTP control connection. This issue arises when a prior connection has been upgraded with STARTTLS and authenticated using a client certificate. As a result, the subsequent connection does not perform a new TLS handshake or a fresh FTP login, allowing the server to inadvertently authorize the second handle using the first handle's certificate identity.
Affected Version(s)
curl 8.21.0