CVE-2026-92387: never-ending loop via server response omission

Q: Which deployments are exposed to this issue?

Deployments using Debian's curl package that connect to FTP, IMAP, POP3, or SMTP servers are exposed when a server can maliciously withhold the final control-response line. Transfers using the same libcurl multi-handle can all be blocked.

Q: What must an attacker control to exploit it?

An attacker needs to operate or control an FTP, IMAP, POP3, or SMTP server that the affected client connects to. The server exploits the issue by permanently omitting the final control-response line.

Q: Will configured transfer timeouts stop the affected transfer?

No. The issue completely bypasses libcurl's configured transfer timeout mechanism, allowing the transfer to block indefinitely.

Published Oct 20, 2026

Updated

By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.

Affected Software

1 affected componentFixes available

debian/curl<=8.14.1-2+deb13u5, <=8.14.1-2+deb13u7, <=8.22.0-1

7.88.1-10+deb12u157.88.1-10+deb12u58.23.0-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/curl to a version that resolves this vulnerability.
Fixed in 7.88.1-10+deb12u15Fixed in 7.88.1-10+deb12u5Fixed in 8.23.0-1

Event History

Oct 14, 2026

CVE Published

via Debian·02:51 PM

Data Sourced

via Debian·02:51 PM

DescriptionAffected Software

Oct 20, 2026

CVE Published

via MITRE·08:19 PM

Data Sourced

via MITRE·08:19 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

Description

Data Sourced

via Ubuntu·11:25 PM

RemedyDescriptionSeverityAffected Software

Data Sourced

via Launchpad·11:25 PM

Description

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Debian's curl package that connect to FTP, IMAP, POP3, or SMTP servers are exposed when a server can maliciously withhold the final control-response line. Transfers using the same libcurl multi-handle can all be blocked.

What must an attacker control to exploit it?

An attacker needs to operate or control an FTP, IMAP, POP3, or SMTP server that the affected client connects to. The server exploits the issue by permanently omitting the final control-response line.

Will configured transfer timeouts stop the affected transfer?

No. The issue completely bypasses libcurl's configured transfer timeout mechanism, allowing the transfer to block indefinitely.

CVE-2026-92387: never-ending loop via server response omission

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker control to exploit it?

Will configured transfer timeouts stop the affected transfer?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker control to exploit it?

Will configured transfer timeouts stop the affected transfer?