curl CVE-2026-86411

Requires an application built on libcurl that performs FTP or FTPS transfers with a client certificate configured (e.g. CURLOPT_SSLCERT) and that reuses connections across multiple transfers within the same handle, such that a later FTP connection inherits a client certificate set for an earlier transfer. LIMITING FACTORS: this is not a default-configuration remote exploit - it depends on client certificate use with FTP(S) specifically, connection reuse being active, and the application mixing differently-configured transfers on one handle; the flaw is client-side logic, not server-triggerable, and no attacker-controlled network payload initiates it. Affected via libcurl up to 8.22.0, fixed in 8.23.0 (exact lower bound truncated in provided data).

This is a LOW-severity vulnerability as rated by the curl project, one of twenty-four flaws disclosed alongside curl 8.23.0. No CVSS vector, CWE, EPSS score, KEV listing, or POC is present in the input, so quantitative exploitation signals are entirely absent - the only severity signal is curl's own 'L' (LOW) rating in the advisory table. This is a client-side connection-reuse logic flaw in libcurl: when an FTP connection is reused, it can improperly inherit a client certificate configured for a different transfer, causing a client certificate to be applied to an FTP connection where it was not intended. The real-world risk is low and conditional, not a widespread remote-exploitation priority: it is not attacker-initiated in the classic sense, requires an application to use libcurl FTP(S) with client certificates across reused connections, and has no confirmed active exploitation. Treat this as a hygiene/patch-on-schedule item rather than an emergency, while noting the caveat that curl is ubiquitously deployed so the patch should still be rolled out broadly. KEY MISSING DATA: no CVSS vector means attack vector, complexity, and privilege requirements cannot be confirmed from the input; the affected version range for this specific CVE is truncated in the provided advisory table and could not be fully read.

An application uses a single libcurl handle to perform multiple FTP/FTPS transfers, one of which is configured with a client certificate (CURLOPT_SSLCERT). On a subsequent transfer, libcurl reuses the existing connection and inherits the client certificate from the earlier transfer, applying it to an FTP connection where it was not intended. No public exploit code was identified at time of analysis, and this requires a specific client-side configuration rather than attacker-driven network input.