by Kastro
Paper/Archive/CVE-2026-86411

CVE-2026-86411

curl curl — FTP connection reuse inherits client-certificate

EPSS 0.2%public exploitCVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 4.4.044 × 200.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.

Affected

ProductAffectedFixed inSource
curl8.21.0 – 8.21.0–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refcurl.se/docs/CVE-2026-86411.jsonrefcurl.se/docs/CVE-2026-86411.htmlexploithackerone.com/reports/3973190