[<prev] [next>] [day] [month] [year] [list]
Message-ID: <9q402657-2253-sq6n-32s8-opn6q2oop62n@unkk.fr>
Date: Wed, 29 Apr 2026 08:00:52 +0200 (CEST)
From: Daniel Stenberg <daniel@...x.se>
To: curl security announcements -- curl users <curl-users@...ts.haxx.se>,
curl-announce@...ts.haxx.se, libcurl hacking <curl-library@...ts.haxx.se>,
oss-security@...ts.openwall.com
Subject: [ADVISORY] curl: CVE-2026-4873: connection reuse ignores TLS
requirement
connection reuse ignores TLS requirement
========================================
Project curl Security Advisory, April 29 2026
[Permalink](https://curl.se/docs/CVE-2026-4873.html)
VULNERABILITY
-------------
A vulnerability exists where a connection requiring TLS incorrectly reuses an
existing unencrypted connection from the same connection pool. If an initial
transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request
to that same host will bypass the TLS requirement and instead transmit data
unencrypted.
INFO
----
This flaw requires a rather special series of events to trigger. Such a series
is unlikely to be used much in the wild.
This issue only happens for transfers done using `IMAP://`, `POP3://` or
`SMTP://` URL schemes. The initial transfer and the second transfer both need
to be done to the same host, use the same credentials and the same URL
schemes. The login and the initial transfer is done over clear-text, so the
user is obviously already accepting an insecure transmission for this. This
flaw still makes it worse as the second transfer is intended to be secured by
TLS but is not.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-4873 to this issue.
CWE-319: Cleartext Transmission of Sensitive Information
Severity: Low
AFFECTED VERSIONS
-----------------
- Affected versions: curl 7.20.0 to and including 8.19.0
- Not affected versions: curl < 7.20.0 and >= 8.20.0
- Introduced-in: https://github.com/curl/curl/commit/ec3bb8f727405642a
libcurl is used by many applications, but not always advertised as such!
This bug is not considered a *C mistake*. It is not likely to have been
avoided had we not been using C.
This flaw also affects the curl command line tool.
SOLUTION
--------
curl 8.20.0 fixes this logical flaw
- Fixed-in: https://github.com/curl/curl/commit/507e7be573b0a76fca597b75
RECOMMENDATIONS
---------------
We suggest you take one of the following actions immediately, in order of
preference:
A - Upgrade to curl and libcurl 8.20.0
B - Apply the patch and rebuild libcurl
C - Do not use clear-text IMAP/POP3/SMTP transfers
TIMELINE
---------
It was reported to the curl project on March 22nd 2026. We contacted
distros@...nwall on April 23.
libcurl 8.20.0 was released on April 29th 2026, coordinated with the
publication of this advisory.
CREDITS
-------
- Reported-by: Arkadi Vainbrand
- Patched-by: Daniel Stenberg
Thanks a lot!
--
/ daniel.haxx.se || https://rock-solid.curl.dev
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
