CVE-2026-4873: connection reuse ignores TLS requirement
A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.
Other sources
connection reuse ignores TLS requirement
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.30.3-14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.1-7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4873?
CVE-2026-4873 has a high severity rating due to the potential for sensitive data exposure over unencrypted connections.
How do I fix CVE-2026-4873?
To fix CVE-2026-4873, ensure that TLS is enforced for all connections and avoid reusing unencrypted connections.
What types of connections are affected by CVE-2026-4873?
CVE-2026-4873 affects connections made via IMAP, SMTP, and POP3 when TLS is required but incorrectly reused.
What are the potential consequences of exploiting CVE-2026-4873?
Exploiting CVE-2026-4873 can lead to sensitive information being intercepted due to clear-text communications.
Which versions of Curl are vulnerable to CVE-2026-4873?
Versions of Curl from 7.20.0 to 8.20.0 are vulnerable to CVE-2026-4873.