CVE-2026-92389: 
cURL vulnerability analysis and mitigation

CVE-2026-92389, named "TFTP direction confusion," is a vulnerability in libcurl's TFTP state machine that fails to validate state transitions against the requested transfer direction. A malicious TFTP server can respond to a client download request in a way that forces libcurl into transmit mode, causing it to leak data from the handle's persistent CURLOPT_READDATA pointer — including sensitive data from prior unrelated operations on reused handles. It affects libcurl versions 7.15.0 through 8.22.0 (inclusive), with the curl command-line tool itself not affected. The vulnerability was reported on September 11, 2026, and publicly disclosed on October 14, 2026, coordinated with the release of curl 8.23.0. It is rated Low severity (CWE-200) with an EPSS score of 0.0 (curl Advisory, GitHub Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). libcurl's TFTP state machine does not enforce that server opening responses correspond to the direction of the client's request — it accepts WRQ (write request) acknowledgments in response to RRQ (read request) operations interchangeably. When an application reuses a curl easy handle across different protocol operations (e.g., an HTTP POST followed by a TFTP download), the CURLOPT_READDATA pointer may still reference data from the prior HTTP operation. A malicious TFTP server can exploit this by responding to a download (RRQ) with a write-mode acknowledgment, tricking libcurl into reading from and transmitting that stale buffer to the attacker's server. The vulnerability was introduced at git commit 56d9624b566ac15ffb4b4b6eef220a5000b767e0 and fixed at 63dd390fab905a239a97e2700532929343ebc4e9 (curl Advisory, curl JSON).

Successful exploitation results in unauthorized disclosure of sensitive data from the application's memory — specifically, data previously written to the curl handle's read buffer from unrelated prior operations, such as HTTP POST body content. This could expose credentials, session tokens, API keys, or other sensitive application data to an attacker-controlled TFTP server. The impact is limited to confidentiality (no integrity or availability impact), and exploitation requires the victim application to reuse curl handles across HTTP and TFTP operations and connect to a malicious TFTP server (curl Advisory, Ubuntu USN-8927-1).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is 0.0, reflecting very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a network-adjacent or network-accessible attacker who can operate or intercept a TFTP server that the victim application connects to, and the victim application must reuse curl handles across HTTP and TFTP operations. The vulnerability was discovered by Joshua Rogers of Aisle Research and reported via HackerOne (curl Advisory).

1. Set up a malicious TFTP server: The attacker deploys a rogue TFTP server (e.g., using a custom implementation) that is reachable by the target application.
2. Identify a vulnerable target: Identify an application using libcurl 7.15.0–8.22.0 that reuses curl easy handles across HTTP POST operations and subsequent TFTP downloads, and that can be directed to connect to the attacker's TFTP server.
3. Trigger a TFTP download request: Cause the target application to initiate a TFTP RRQ (read request) to the attacker's server, ideally after the handle has been used for an HTTP POST containing sensitive data.
4. Respond with a write-mode acknowledgment: The malicious TFTP server responds to the RRQ with a WRQ acknowledgment (opcode 4, block 0), which libcurl's flawed state machine accepts without validating the transfer direction.
5. Receive leaked data: libcurl, now in transmit mode, reads from the handle's persistent CURLOPT_READDATA pointer and transmits the stale buffer contents (e.g., HTTP POST body data) to the attacker's TFTP server, completing the data exfiltration (curl Advisory).

• Network: Unexpected outbound TFTP (UDP port 69) traffic from application servers, particularly following HTTP POST operations; TFTP DATA packets sent from the client to an external or unexpected TFTP server address.
• Logs: Application logs showing TFTP transfer activity on curl handles previously used for HTTP operations; curl debug logs (CURLOPT_VERBOSE) indicating a TFTP write operation was initiated when a read was requested.
• Process/Application Behavior: Curl-based applications unexpectedly transmitting data during what should be a TFTP download operation; anomalous data appearing in TFTP server logs on attacker-controlled infrastructure.

Upgrade libcurl to a patched version: 8.23.0 (main branch), 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), or 8.14.3 (8.14.x branch). As a workaround, use fresh (new) curl easy handles for each TFTP operation rather than reusing handles that have been used for HTTP POST or other operations — this prevents stale CURLOPT_READDATA data from being accessible during TFTP transfers. Additionally, restrict TFTP usage to trusted servers only, or disable TFTP support in libcurl if it is not required by the application. Ubuntu has released patched packages via USN-8927-1 (Ubuntu 26.04 LTS) and USN-8927-2 (Ubuntu 26.10) (curl Advisory, Ubuntu USN-8927-1, Ubuntu USN-8927-2).

The vulnerability was part of a broader curl 8.23.0 security release that addressed 24 vulnerabilities, which received coverage from technology media including Heise Online. The curl project coordinated disclosure responsibly, with the advisory published simultaneously with the patched release on October 14, 2026. No significant independent researcher commentary or notable social media discussion specific to CVE-2026-92389 has been identified beyond standard vulnerability tracking and distribution advisories.