CVE-2026-92389

HighCVSS 8.1/10Last modified Oct 30, 2026

Description

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
curl	curl	>= 8.22.0, <= 8.22.0; >= 8.21.0, <= 8.21.0; >= 8.20.0, <= 8.20.0; >= 8.19.0, <= 8.19.0; >= 8.18.0, <= 8.18.0; >= 8.17.0, <= 8.17.0; >= 8.16.0, <= 8.16.0; >= 8.15.0, <= 8.15.0; >= 8.14.1, <= 8.14.1; >= 8.14.0, <= 8.14.0; >= 8.13.0, <= 8.13.0; >= 8.12.1, <= 8.12.1; >= 8.12.0, <= 8.12.0; >= 8.11.1, <= 8.11.1; >= 8.11.0, <= 8.11.0; >= 8.10.1, <= 8.10.1; >= 8.10.0, <= 8.10.0; >= 8.9.1, <= 8.9.1; >= 8.9.0, <= 8.9.0; >= 8.8.0, <= 8.8.0

References

Timeline

Published: Oct 20, 2026
Last modified: Oct 30, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-92396.4The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all ver CVE-2026-923907.5When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Ear CVE-2026-923917.5A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations.CVE-2026-923928.1During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading CVE-2026-923932.0Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workl CVE-2026-923959.1@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify requ CVE-2026-923966.8The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ow CVE-2026-923979.1A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this vulnerability is the function cc_set of the file uni CVE-2026-923989.1A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this issue is some unknown functionality of the file /etc/rg_c CVE-2026-923997.3A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame of the file src/utils/rmt_ws.c of the c CVE-2026-92404.3The Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due CVE-2026-924005.3The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confir