Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim initiates TFTP transfer via libcurl
-
DeliveryConnect to malicious/misbehaving TFTP server
-
ExploitServer triggers read/write direction confusion
-
Executionlibcurl mishandles transfer direction
-
ImpactIncorrect data handling or minor information exposure
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the victim application to actively use the TFTP protocol via curl/libcurl (e.g. a tftp:// URL or CURLPROTO_TFTP transfer) - a legacy, non-default, and rarely-enabled protocol - and to transfer data with a malicious or misbehaving TFTP server that triggers confusion between the read (download) and write (upload) transfer direction. Limiting factors: TFTP is almost never used in modern deployments, the attacker must control or influence the TFTP server endpoint, and the affected code path is not reached in the overwhelming majority of curl use cases (HTTP/HTTPS). Affected versions span 7.15.0 through 8.22.0; the fix is in 8.23.0. |
| Impact | This is a genuinely low-priority issue despite affecting an ubiquitously deployed library. The curl project itself rated CVE-2026-92389 as severity LOW, and no CVSS vector, EPSS score, KEV listing, or public exploit is present in the provided data. The affected component is libcurl's TFTP handler ('lib' tag), and TFTP is a rarely-used, legacy, non-default protocol that most curl deployments never invoke. All exploitation signals are therefore weak: exploitation requires the victim to actively perform a TFTP transfer against an attacker-influenced or misbehaving server, which is a narrow and uncommon operation. No CVSS data is provided, so attack vector, complexity, and privilege requirements cannot be confirmed from the input and are inferred only from the vulnerability name and the project's LOW rating. In short, while libcurl's footprint is enormous, the realistic attack surface for this specific flaw is small, and there is no evidence of active exploitation or a public PoC - this should be patched in the normal maintenance cycle, not treated as an emergency. |
| Exploit ScenarioDerived | A victim uses curl or libcurl to transfer a file over TFTP (e.g. a tftp:// URL) against a malicious or malfunctioning TFTP server. The server exploits confusion between read (download) and write (upload) direction handling in libcurl's TFTP code, causing curl to mishandle the transfer direction and potentially process or move data incorrectly. No public exploit identified at time of analysis, and the scenario requires the uncommon use of the TFTP protocol. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Transfer-direction confusion in curl and libcurl's TFTP handling lets a malicious or misbehaving TFTP server cause a client to mishandle a read (download) transfer as a write (upload) or vice versa, affecting releases from 7.15.0 through 8.22.0. The curl project rates this LOW severity, and the independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - high attack complexity, unauthenticated per the vector's PR:N, with only limited confidentiality impact and no integrity or availability impact. The fix ships in curl 8.23.0; there is no public exploit identified at time of analysis and no evidence of active exploitation, and because reaching the vulnerable code requires the application to actually perform a tftp:// transfer against an attacker-influenced server, the practical risk is low despite curl's ubiquity.
RemediationAI
Vendor-released patch: upgrade to curl/libcurl 8.23.0, which fixes this issue along with the other twenty-three advisories shipped in the same release (curl.se/docs/security.html). If an immediate upgrade is not possible, the most effective compensating control is to eliminate the vulnerable code path: build curl/libcurl with TFTP disabled (--disable-tftp) or constrain protocol use at runtime with CURLOPT_PROTOCOLS_STR / CURLOPT_REDIR_PROTOCOLS (or the curl tool's --proto / --proto-redir options) to HTTP and HTTPS only - the trade-off is loss of tftp:// functionality for netboot, firmware transfer, or embedded-device use cases that rely on it. Additionally, never pass attacker-controlled strings into tftp:// URLs and ensure redirects cannot pivot into TFTP, since the attacker must control or influence the TFTP server endpoint for exploitation. Organizations that cannot upgrade on their own cadence can obtain backported security fixes through the Rock-solid curl long-term-support program (https://rock-solid.curl.dev), and should prioritize 8.23.0 in any case because it also resolves the HIGH-severity HTTP/2 upload use-after-free (CVE-2026-92392). No vendor-released patch exists for versions below 8.23.0 other than the LTS backport channel.
Affected ProductsAI
curl and libcurl, versions 7.15.0 through 8.22.0 inclusive, are vulnerable according to the curl project's published vulnerability table (entry 232, flagged as a libcurl issue); the first vulnerable release is 7.15.0 and the last is 8.22.0, with 8.23.0 containing the fix. No CPE strings were included in the provided intelligence, so affected deployments should be matched by curl/libcurl version rather than by CPE. Vendor information is published at https://curl.se/docs/security.html and in the oss-security release announcement at https://seclists.org/oss-sec/2026/q4/154; commercial long-term-support builds are documented at https://rock-solid.curl.dev. Because libcurl is embedded in an extremely large number of applications and appliances, the true affected surface extends to any product statically or dynamically linking an affected libcurl and enabling TFTP support.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TFTP (Trivial File Transfer Protocol) is a minimal UDP-based file transfer protocol, classically bound to port 69, that supports a read request (RRQ, download) and a write request (WRQ, upload). curl/libcurl implements tftp:// transfers for both directions, and the vulnerability arises from a confusion between these two transfer directions in that code - the direction state used by libcurl can be mismatched, so data crossing between client and server is handled under the wrong transfer semantics. The provided input assigns no CWE identifier, but the flaw class is a state/logic confusion in a per-protocol transfer state machine rather than a memory-safety defect; the curl vulnerability table marks entry 232 as a 'lib' (libcurl) issue, confirming the library, not the curl command-line tool, is the affected component. Curl's table lists the first vulnerable version as 7.15.0 and the last as 8.22.0, with the fix landing in 8.23.0. No CPE strings were supplied in the input data, so exact product enumeration beyond 'curl and libcurl' cannot be confirmed from CPE data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Network-reachable TFTP server but AC:H because the victim must use the uncommon TFTP protocol and hit the direction-confusion path; limited impact consistent with the vendor LOW rating.
Description PRE-NVD
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub PoC
Exploit-DB