CVE-2026-86411

Not scored yetLast modified Oct 22, 2026

Description

An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 20, 2026
Last modified
Oct 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-86412A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using CVE-2026-86413When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credenCVE-2026-86414An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, CVE-2026-86415libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated SchannCVE-2026-864165.4ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() andCVE-2026-864174.3Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetcCVE-2026-864184.3Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restriCVE-2026-864199.1Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery fuCVE-2026-864207.5ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated CVE-2026-864217.5ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation wiCVE-2026-864223.3ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers tCVE-2026-864235.5ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A c
CVE-2026-86411: Unscored | Vulnix