libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for… (CVE-2026-92389)
Description
A vulnerability in libcurl's TFTP state machine allows a malicious TFTP server to manipulate the client's transfer mode. The state machine does not properly validate state transitions against the requested transfer direction, causing the client to accept server responses for both read and write operations interchangeably. This can lead libcurl to transmit unintended data from a reused handle, potentially leaking data from unrelated prior operations.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, causing libcurl to consume and transmit data from the handle's persistent CURLOPT_READDATA pointer. This includes data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.
Potential Impact
This vulnerability can cause libcurl clients to inadvertently transmit sensitive or unrelated data from previous operations when communicating with a malicious TFTP server. This data leakage could expose confidential information that was not intended to be sent over the TFTP protocol.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9rxv-c97x-mrjr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-92389"]
Threat ID: 6ad7ec102cdf04f6566aefb4
Added to database: 10/20/2026, 22:32:48 UTC
Last enriched: 10/20/2026, 22:35:37 UTC
Last updated: 10/20/2026, 22:35:37 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.