CVE-2026-92389: TFTP direction confusion

Q: Who is exposed to this issue?

Applications using libcurl for TFTP downloads are exposed when they connect to a malicious TFTP server. The risk is especially relevant if the application reuses a curl handle after operations that supplied sensitive data through CURLOPT_READDATA, such as an HTTP POST request.

Q: What does an attacker need to exploit it?

An attacker needs to control or impersonate the TFTP server used for a download request. The server must send an opening response that causes the client to enter transmit mode instead of the requested download mode.

Q: What data could be disclosed?

The client may transmit data read through the handle's persistent CURLOPT_READDATA pointer. This can include data left over from unrelated earlier operations performed with the same reused handle, including HTTP POST data.

Published Oct 20, 2026

Updated

Last updated 14 October 2026

Other sources

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent CURLOPTREADDATA pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.

— MITRE

Affected Software

1 affected componentFixes available

debian/curl<=7.88.1-10+deb12u15, <=7.88.1-10+deb12u5, <=8.14.1-2+deb13u5, <=8.14.1-2+deb13u7, <=8.22.0-1

8.23.0-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/curl to a version that resolves this vulnerability.
Fixed in 8.23.0-1

Event History

Oct 15, 2026

CVE Published

via Ubuntu·02:50 PM

Data Sourced

via Ubuntu·02:50 PM

RemedyDescriptionSeverityAffected Software

Data Sourced

via Debian·02:51 PM

DescriptionAffected Software

Oct 20, 2026

CVE Published

via MITRE·08:21 PM

Data Sourced

via MITRE·08:21 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

Description

Frequently Asked Questions

Who is exposed to this issue?

Applications using libcurl for TFTP downloads are exposed when they connect to a malicious TFTP server. The risk is especially relevant if the application reuses a curl handle after operations that supplied sensitive data through CURLOPT_READDATA, such as an HTTP POST request.

What does an attacker need to exploit it?

An attacker needs to control or impersonate the TFTP server used for a download request. The server must send an opening response that causes the client to enter transmit mode instead of the requested download mode.

What data could be disclosed?

The client may transmit data read through the handle's persistent CURLOPT_READDATA pointer. This can include data left over from unrelated earlier operations performed with the same reused handle, including HTTP POST data.

CVE-2026-92389: TFTP direction confusion

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What data could be disclosed?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What data could be disclosed?