Description
A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.
Metrics
CVSS 3.1 5.9/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| curl | curl | >= 7.20.0, < 8.14.2; >= 8.15.0, < 8.16.1; >= 8.17.0, < 8.20.0 |
| curl | curl | >= ec3bb8f727405642a471b4b1b9eb0118fc003104, < 507e7be573b0a76fca597b75ff7cb27a66e7d865 |
| curl | curl | 8.19.0; 8.18.0; 8.17.0; 8.16.0; 8.15.0; 8.14.1; 8.14.0; 8.13.0; 8.12.1; 8.12.0; 8.11.1; 8.11.0; 8.10.1; 8.10.0; 8.9.1; 8.9.0; 8.8.0; 8.7.1; 8.7.0; 8.6.0 |
References
- https://curl.se/docs/CVE-2026-4873.htmlPatch, Vendor Advisory
- https://curl.se/docs/CVE-2026-4873.jsonVendor Advisory
- https://hackerone.com/reports/3621851Exploit, Issue Tracking, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/04/29/7Mailing List, Patch, Third Party Advisory
Timeline
- Published
- May 13, 2026
- Last modified
- Nov 11, 2026
- NVD status
- Modified