CVE-2026-92389: TFTP direction confusion
Last updated 20 October 2026
Other sources
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent CURLOPTREADDATA pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.23.0-1 - Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 8.23.0-r0 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.35.0-1ubuntu2.20+esm24 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.47.0-1ubuntu2.19+esm21 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.58.0-2ubuntu3.24+esm15 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.68.0-1ubuntu2.25+esm10 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.81.0-1ubuntu1.30 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.5.0-2ubuntu10.16 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.20.0-2ubuntu11.1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.18.0-1ubuntu2.8 - Upgrade
Upgrade
azurelinux/curlto a version that resolves this vulnerability.Fixed in 8.11.1-13
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using libcurl for TFTP downloads are exposed when they connect to a malicious TFTP server. The risk is especially relevant if the application reuses a curl handle after operations that supplied sensitive data through CURLOPT_READDATA, such as an HTTP POST request.
What does an attacker need to exploit it?
An attacker needs to control or impersonate the TFTP server used for a download request. The server must send an opening response that causes the client to enter transmit mode instead of the requested download mode.
What data could be disclosed?
The client may transmit data read through the handle's persistent CURLOPT_READDATA pointer. This can include data left over from unrelated earlier operations performed with the same reused handle, including HTTP POST data.