CVE-2026-92387: never-ending loop via server response omission
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.
Other sources
never-ending loop via server response omission
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u15Fixed in 7.88.1-10+deb12u5Fixed in 8.23.0-1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.20.0-2ubuntu11.1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.18.0-1ubuntu2.8 - Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 8.23.0-r0 - Upgrade
Upgrade
azurelinux/curlto a version that resolves this vulnerability.Fixed in 8.11.1-13
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Debian's curl package that connect to FTP, IMAP, POP3, or SMTP servers are exposed when a server can maliciously withhold the final control-response line. Transfers using the same libcurl multi-handle can all be blocked.
What must an attacker control to exploit it?
An attacker needs to operate or control an FTP, IMAP, POP3, or SMTP server that the affected client connects to. The server exploits the issue by permanently omitting the final control-response line.
Will configured transfer timeouts stop the affected transfer?
No. The issue completely bypasses libcurl's configured transfer timeout mechanism, allowing the transfer to block indefinitely.