CVE-2026-92389
HIGHCVSS 8.1/10EPSS 0.26%
Last modified
CVE-2026-92389 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| curl | curl | >= 8.22.0, <= 8.22.0; >= 8.21.0, <= 8.21.0; >= 8.20.0, <= 8.20.0; >= 8.19.0, <= 8.19.0; >= 8.18.0, <= 8.18.0; >= 8.17.0, <= 8.17.0; >= 8.16.0, <= 8.16.0; >= 8.15.0, <= 8.15.0; >= 8.14.1, <= 8.14.1; >= 8.14.0, <= 8.14.0; >= 8.13.0, <= 8.13.0; >= 8.12.1, <= 8.12.1; >= 8.12.0, <= 8.12.0; >= 8.11.1, <= 8.11.1; >= 8.11.0, <= 8.11.0; >= 8.10.1, <= 8.10.1; >= 8.10.0, <= 8.10.0; >= 8.9.1, <= 8.9.1; >= 8.9.0, <= 8.9.0; >= 8.8.0, <= 8.8.0; >= 8.7.1, <= 8.7.1; >= 8.7.0, <= 8.7.0; >= 8.6.0, <= 8.6.0; >= 8.5.0, <= 8.5.0; >= 8.4.0, <= 8.4.0; >= 8.3.0, <= 8.3.0; >= 8.2.1, <= 8.2.1; >= 8.2.0, <= 8.2.0; >= 8.1.2, <= 8.1.2; >= 8.1.1, <= 8.1.1; >= 8.1.0, <= 8.1.0; >= 8.0.1, <= 8.0.1; >= 8.0.0, <= 8.0.0; >= 7.88.1, <= 7.88.1; >= 7.88.0, <= 7.88.0; >= 7.87.0, <= 7.87.0; >= 7.86.0, <= 7.86.0; >= 7.85.0, <= 7.85.0; >= 7.84.0, <= 7.84.0; >= 7.83.1, <= 7.83.1; >= 7.83.0, <= 7.83.0; >= 7.82.0, <= 7.82.0; >= 7.81.0, <= 7.81.0; >= 7.80.0, <= 7.80.0; >= 7.79.1, <= 7.79.1; >= 7.79.0, <= 7.79.0; >= 7.78.0, <= 7.78.0; >= 7.77.0, <= 7.77.0; >= 7.76.1, <= 7.76.1; >= 7.76.0, <= 7.76.0; >= 7.75.0, <= 7.75.0; >= 7.74.0, <= 7.74.0; >= 7.73.0, <= 7.73.0; >= 7.72.0, <= 7.72.0; >= 7.71.1, <= 7.71.1; >= 7.71.0, <= 7.71.0; >= 7.70.0, <= 7.70.0; >= 7.69.1, <= 7.69.1; >= 7.69.0, <= 7.69.0; >= 7.68.0, <= 7.68.0; >= 7.67.0, <= 7.67.0; >= 7.66.0, <= 7.66.0; >= 7.65.3, <= 7.65.3; >= 7.65.2, <= 7.65.2; >= 7.65.1, <= 7.65.1; >= 7.65.0, <= 7.65.0; >= 7.64.1, <= 7.64.1; >= 7.64.0, <= 7.64.0; >= 7.63.0, <= 7.63.0; >= 7.62.0, <= 7.62.0; >= 7.61.1, <= 7.61.1; >= 7.61.0, <= 7.61.0; >= 7.60.0, <= 7.60.0; >= 7.59.0, <= 7.59.0; >= 7.58.0, <= 7.58.0; >= 7.57.0, <= 7.57.0; >= 7.56.1, <= 7.56.1; >= 7.56.0, <= 7.56.0; >= 7.55.1, <= 7.55.1; >= 7.55.0, <= 7.55.0; >= 7.54.1, <= 7.54.1; >= 7.54.0, <= 7.54.0; >= 7.53.1, <= 7.53.1; >= 7.53.0, <= 7.53.0; >= 7.52.1, <= 7.52.1; >= 7.52.0, <= 7.52.0; >= 7.51.0, <= 7.51.0; >= 7.50.3, <= 7.50.3; >= 7.50.2, <= 7.50.2; >= 7.50.1, <= 7.50.1; >= 7.50.0, <= 7.50.0; >= 7.49.1, <= 7.49.1; >= 7.49.0, <= 7.49.0; >= 7.48.0, <= 7.48.0; >= 7.47.1, <= 7.47.1; >= 7.47.0, <= 7.47.0; >= 7.46.0, <= 7.46.0; >= 7.45.0, <= 7.45.0; >= 7.44.0, <= 7.44.0; >= 7.43.0, <= 7.43.0; >= 7.42.1, <= 7.42.1; >= 7.42.0, <= 7.42.0; >= 7.41.0, <= 7.41.0; >= 7.40.0, <= 7.40.0; >= 7.39.0, <= 7.39.0; >= 7.38.0, <= 7.38.0; >= 7.37.1, <= 7.37.1; >= 7.37.0, <= 7.37.0; >= 7.36.0, <= 7.36.0; >= 7.35.0, <= 7.35.0; >= 7.34.0, <= 7.34.0; >= 7.33.0, <= 7.33.0; >= 7.32.0, <= 7.32.0; >= 7.31.0, <= 7.31.0; >= 7.30.0, <= 7.30.0; >= 7.29.0, <= 7.29.0; >= 7.28.1, <= 7.28.1; >= 7.28.0, <= 7.28.0; >= 7.27.0, <= 7.27.0; >= 7.26.0, <= 7.26.0; >= 7.25.0, <= 7.25.0; >= 7.24.0, <= 7.24.0; >= 7.23.1, <= 7.23.1; >= 7.23.0, <= 7.23.0; >= 7.22.0, <= 7.22.0; >= 7.21.7, <= 7.21.7; >= 7.21.6, <= 7.21.6; >= 7.21.5, <= 7.21.5; >= 7.21.4, <= 7.21.4; >= 7.21.3, <= 7.21.3; >= 7.21.2, <= 7.21.2; >= 7.21.1, <= 7.21.1; >= 7.21.0, <= 7.21.0; >= 7.20.1, <= 7.20.1; >= 7.20.0, <= 7.20.0; >= 7.19.7, <= 7.19.7; >= 7.19.6, <= 7.19.6; >= 7.19.5, <= 7.19.5; >= 7.19.4, <= 7.19.4; >= 7.19.3, <= 7.19.3; >= 7.19.2, <= 7.19.2; >= 7.19.1, <= 7.19.1; >= 7.19.0, <= 7.19.0; >= 7.18.2, <= 7.18.2; >= 7.18.1, <= 7.18.1; >= 7.18.0, <= 7.18.0; >= 7.17.1, <= 7.17.1; >= 7.17.0, <= 7.17.0; >= 7.16.4, <= 7.16.4; >= 7.16.3, <= 7.16.3; >= 7.16.2, <= 7.16.2; >= 7.16.1, <= 7.16.1; >= 7.16.0, <= 7.16.0; >= 7.15.5, <= 7.15.5; >= 7.15.4, <= 7.15.4; >= 7.15.3, <= 7.15.3; >= 7.15.2, <= 7.15.2; >= 7.15.1, <= 7.15.1; >= 7.15.0, <= 7.15.0 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-92389?
libcurl's TFTP state machine fails to validate state transitions against the
requested transfer direction, accepting opening server responses for both
reads and writes interchangeably. A malicious TFTP server can respond to a
download request in a way that forces the client into transmit mode, prompting
libcurl to consume and transmit data from the handle's persistent
`CURLOPT_READDATA` pointer - including data remaining from unrelated prior
operations, such as an HTTP POST request executed on a reused handle.
How severe is CVE-2026-92389?
CVE-2026-92389 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 0.26% probability of exploitation in the next 30 days.
How do I fix CVE-2026-92389?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92382An out-of-bounds write flaw was found in usbredir. Starting …4.1
- CVE-2026-92383A security vulnerability has been detected in PbootCMS up to…4.3
- CVE-2026-92385A vulnerability has been found in SourceCodester Online Food…2.4
- CVE-2026-92386When writing a long cookie name and value to a Netscape cook…8.1
- CVE-2026-92387By permanently omitting the final control-response line, a m…8.1
- CVE-2026-92388When an FTP wildcard `LIST` operation fails, libcurl omits t…9.1
- CVE-2026-9239The Meow Gallery plugin for WordPress is vulnerable to Store…6.4
- CVE-2026-92390When invoked with `--remote-header-name` (`-J`), curl fails …7.5
- CVE-2026-92391A deeply nested multipart MIME structure constructed via the…7.5
- CVE-2026-92392During an upload, curl mishandles HTTP/2 `RST_STREAM` receiv…8.1
- CVE-2026-92393Apache YuniKorn 1.9.0 and earlier does not implement label a…2
- CVE-2026-92395@fastify/proxy-addr is a Fastify plugin that determines a re…9.1
Are you affected by CVE-2026-92389?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST