Every CVE Search/ Get API key

CVE-2026-86411

FTP connection reuse inherits client-certificate

9.1 CriticalFix available

An ftp:// transfer configured with CURLUSESSL_NONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.43%Up 0.3 points since Oct 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.1

FTP connection reuse inherits client-certificate

An ftp:// transfer configured with CURLUSESSL_NONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.

Record
CVE-2026-86411
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-488
Updated
2026-11-02
EUVDEUVD-2026-105276 9.1

An ftp:// transfer configured with CURLUSESSL_NONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.

Record
EUVD-2026-105276
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-533v-mrfx-494r 9.1

An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection...

An ftp:// transfer configured with CURLUSESSL_NONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.

Record
GHSA-533v-mrfx-494r
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-488
Updated
2026-11-02
NVD 9.1

An ftp:// transfer configured with CURLUSESSL_NONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.

Record
CVE-2026-86411
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-488
Updated
2026-11-02
OSVALPINE-CVE-2026-86411 9.1

An ftp:// transfer configured with CURLUSESSL_NONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.

Record
ALPINE-CVE-2026-86411
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVBELL-CVE-2026-86411 9.1
Record
BELL-CVE-2026-86411
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2026-86411 9.1

An ftp:// transfer configured with CURLUSESSL_NONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.

Record
DEBIAN-CVE-2026-86411
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:82895 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:82895
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCURL-CVE-2026-86411 No score

FTP connection reuse inherits client-certificate

An ftp:// transfer configured with CURLUSESSL_NONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.

Record
CURL-CVE-2026-86411
Updated
2026-11-02
OSVMGASA-2026-0515 No score

Updated curl package fixes security vulnerabilities

curl 8.23.0 has been released. It fixes 24 CVEs since 8.22.0, listed at https://curl.se/docs/security.html Not all of theses CVEs affect Mageia. Of the ones fixed in 8.23.0, these are the ones that do: CVE-2026-86410: redirect to SFTP or SCP bypasses host verification CVE-2026-86412: server-set cookie erases cookie jar CVE-2026-86413: Negotiate credentials sent to redirected origin CVE-2026-86414: leaking host credentials to HTTP proxy CVE-2026-86415: auto client cert connection reuse mixup CVE-2026-87861: cross-origin reuse of a Negotiate connection CVE-2026-87862: HSTS cache import drops longer-lived child CVE-2026-87863: HSTS response erases persisted entries CVE-2026-92386: server-set cookie aborts cookie jar load CVE-2026-92387: never-ending loop via server response omission CVE-2026-92388: FTP wildcard write callback mixup CVE-2026-92389: TFTP direction confusion CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints CVE-2026-92391: curl_mime_free stack overflow by recursion CVE-2026-92392: HTTP/2 upload Use-After-Free CVE-2026-94265: Authorization: Negotiate sent to foreign origin CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL CVE-2026-107929: local interface connection reuse mixup There were also some CVE IDs released at the same time that were fixed earlier, in 8.22.0, but just announced now: CVE-2026-86409: stale SigV4 headers sent unintended CVE-2026-86411: FTP connection reuse inherits client-certificate CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection Here are the CVEs fixed in 8.22.0, which wasn't released in mga10 and so are only getting fixed now: CVE-2026-13608: OpenLDAP SASL authentication bypass CVE-2026-18924: HTTP/2 server push UAF CVE-2026-19931: Negotiate ambient user conn reuse CVE-2026-80229: OpenSSL provider use-after-free CVE-2026-80230: OpenSSL pinning bypass CVE-2026-80255: secure cookie attribute bypass with tab CVE-2026-82209: domain-scoped PSL domain cookie

Record
MGASA-2026-0515
Updated
2026-11-02
OSVopenSUSE-SU-2026:12150-1 No score

curl-8.23.0-1.1 on GA media

These are all security issues fixed in the curl-8.23.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12150-1
Updated
2026-11-02
OSVSUSE-SU-2026:5068-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
  • CVE-2026-9546: sending old referer (bsc#1268419).
  • CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
  • CVE-2026-11564: Native CA trust persist (bsc#1268424).
  • CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
  • CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
  • CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
  • CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
  • CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
  • CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
  • CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
  • CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
  • CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
  • CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
  • CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
  • CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
  • CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
  • CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
  • CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
  • CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
  • CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
  • CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
  • CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
  • CVE-2026-92389: TFTP direction confusion (bsc#1285015).
  • CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
  • CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
  • CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
  • CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
  • CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
  • CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

Changes for curl:

  • Updated curl to version 8.22.0. (jsc#PED-16984)
Record
SUSE-SU-2026:5068-1
Updated
2026-11-03
OSVSUSE-SU-2026:5069-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
  • CVE-2026-9546: sending old referer (bsc#1268419).
  • CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
  • CVE-2026-11564: Native CA trust persist (bsc#1268424).
  • CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
  • CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
  • CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
  • CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
  • CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
  • CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
  • CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
  • CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
  • CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
  • CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
  • CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
  • CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
  • CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
  • CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
  • CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
  • CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
  • CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
  • CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
  • CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
  • CVE-2026-92389: TFTP direction confusion (bsc#1285015).
  • CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
  • CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
  • CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
  • CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
  • CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
  • CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

Changes for curl:

  • Updated to version 8.22.0. (jsc#PED-16984)
Record
SUSE-SU-2026:5069-1
Updated
2026-11-03

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Alpine:v3.23
 before 8.23.0-r0
8.23.0-r0
curl
Alpine:v3.24
 before 8.23.0-r0
8.23.0-r0
curl
Alpaquita:23
 8.1.0-r2 up to 8.22.0-r0
8.22.0-r0
curl
Alpaquita:25
 8.14.0-r1 up to 8.22.0-r0
8.22.0-r0
curl
Alpaquita:stream
 8.1.2-r0 up to 8.22.0-r0
8.22.0-r0
curl
BellSoft Hardened Containers:stream
 8.1.2-r0 up to 8.22.0-r0
8.22.0-r0
curl
Debian:14
 before 8.22.0-1, plus listed versions
8.14.1-28.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp1
Show 45 moreShow less
8.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0-18.17.0-28.17.0-38.17.0~rc1-1~exp18.17.0~rc2-18.17.0~rc3-18.18.0-18.18.0-1~bpo13+18.18.0-28.18.0~rc1-1+exp18.18.0~rc2-18.18.0~rc3-18.19.0-18.19.0-1+exp18.19.0-1~bpo13+18.19.0-28.19.0-38.19.0-3+exp18.19.0-3+exp28.19.0~rc1-1~exp18.19.0~rc2-18.19.0~rc2-28.19.0~rc3-18.20.0-18.20.0-1+exp8.20.0-28.20.0-2+exp18.20.0-2~bpo13+18.20.0-38.20.0-48.20.0-5
8.22.0-1
curl
Mageia:10
From an advisory covering 31 CVEs
 before 8.23.0-1.mga10
8.23.0-1.mga10
curl
Red Hat:hummingbird:1
From an advisory covering 26 CVEs
 before 0:8.23.0-0.1.hum1
0:8.23.0-0.1.hum1
libcurl
Red Hat:hummingbird:1
From an advisory covering 26 CVEs
 before 0:8.23.0-0.1.hum1
0:8.23.0-0.1.hum1
Show 6 moreShow less
Affected packages
PackageAffectedFixed
libcurl-devel
Red Hat:hummingbird:1
From an advisory covering 26 CVEs
 before 0:8.23.0-0.1.hum1
0:8.23.0-0.1.hum1
libcurl-minimal
Red Hat:hummingbird:1
From an advisory covering 26 CVEs
 before 0:8.23.0-0.1.hum1
0:8.23.0-0.1.hum1
curl
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 31 CVEs
 before 8.22.0-150700.7.33.1
8.22.0-150700.7.33.1
curl
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 31 CVEs
 before 8.22.0-150600.4.58.1
8.22.0-150600.4.58.1
curl
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 31 CVEs
 before 8.22.0-150600.4.58.1
8.22.0-150600.4.58.1
curl
openSUSE:Tumbleweed
From an advisory covering 23 CVEs
 before 8.23.0-1.1
8.23.0-1.1

History

History
RecordedChangedSources
affected
affected, aliases, facts, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-86411 is a critical vulnerability (CVSS 9.1) in Curl, published October 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in curl 8.23.0-r0.

References

Show 187 moreShow less
This page doesn't list everything

Left out here: 22 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open