By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its… (CVE-2026-92387)

CVE-2026-92387 describes a vulnerability in libcurl where a malicious server for FTP, IMAP, POP3, or SMTP protocols can exploit the client by never sending the final control-response line. This omission causes libcurl to bypass its transfer timeout mechanism, resulting in indefinite blocking of all concurrent transfers bound to the same multi-handle. The vulnerability affects the transfer timeout logic in libcurl's multi-handle operations for these protocols.

The vulnerability allows a malicious server to cause indefinite blocking of concurrent transfers in libcurl clients using multi-handles, effectively causing denial of service for those transfers. There is no information about code execution or data compromise, only transfer blocking.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when connecting to untrusted FTP, IMAP, POP3, or SMTP servers and consider limiting use of multi-handle transfers with these protocols.