CVE-2026-86411: FTP connection reuse inherits client-certificate
An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.
Other sources
FTP connection reuse inherits client-certificate
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 8.23.0-r0 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.22.0-1 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u15Fixed in 7.88.1-10+deb12u5Fixed in 8.14.1-2+deb13u5Fixed in 8.14.1-2+deb13u7Fixed in 8.22.0-1Fixed in 8.23.0-1
Event History
Frequently Asked Questions
Who is exposed to this connection-reuse issue?
Applications using libcurl connection pooling are exposed when one easy handle upgrades an FTP control connection with STARTTLS and authenticates with a client certificate, then another handle requests ftp:// with CURLUSESSL_NONE and reuses that pooled connection.
What must an attacker or unintended caller be able to do to trigger the identity mix-up?
They need to cause or obtain use of a pooled FTP control connection previously authenticated with a client certificate, followed by an FTP transfer configured with CURLUSESSL_NONE. The second transfer does not perform a new TLS handshake or FTP login, so it is authorized as the prior certificate identity.
Is a non-TLS FTP configuration sufficient to avoid the issue?
No. The affected second transfer is explicitly configured with CURLUSESSL_NONE; the issue occurs when it reuses a control connection that an earlier handle upgraded with STARTTLS and authenticated using a client certificate.
How can an application determine whether it may be affected?
Review whether it shares libcurl's connection pool across easy handles that mix FTP transfers using client-certificate STARTTLS with transfers configured using CURLUSESSL_NONE. Affected behavior requires reuse of the earlier authenticated FTP control connection rather than establishing a new connection and login.