Bug 2550364 (CVE-2026-86411)

Summary:	CVE-2026-86411 curl: curl: FTP connection reuse inherits client-certificate
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	anthomas, csutherl, ehelms, ggainey, jclere, jpasqual, juwatts, mdellweg, mhulan, nmoumoul, osousa, pcreech, pjindal, plodge, rchan, rekumar, rhel-process-autobot, security-response-team, smallamp, szappis, tmalecek, vchlup, vvoronko, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in curl that can allow unauthorized access through improper session reuse. When an unencrypted File Transfer Protocol (FTP) transfer reuses a pooled connection previously authenticated with a client certificate and upgraded using Transport Layer Security (TLS), curl fails to perform a new handshake or authentication. As a result, the subsequent transfer operates under the prior session's identity, allowing it to perform operations on the remote server with unintended authorization.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-10-14

Description OSIDB Bzimport 2026-10-13 11:37:16 UTC

An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP
control connection that a previous easy handle upgraded with `STARTTLS` and
authenticated using a client certificate. The second handle performs neither a
new TLS handshake nor a new FTP login, so the server continues to authorize it
under the first handle's certificate identity.

* INFO

FTP transfers using client certificates are rare.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-86411 to this issue.

CWE-488: Exposure of Data Element to Wrong Session

Severity: Low

** AFFECTED VERSIONS

- Affected version: curl 8.21.0
- Not affected versions: curl < 8.21.0 and >= 8.22.0
- Introduced-in: https://github.com/curl/curl/commit/4ff212f8ed328fb95261e11a

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

** SOLUTION

- Fixed-in: https://github.com/curl/curl/commit/72352daba01ba8072b6c1c0254cb7

** TIMELINE

This issue was reported to the curl project on August 27, 2026.

curl 8.22.0 was released on September 2, 2026. This advisory was published on
October 14, 2026.

** CREDITS

- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Stefan Eissing

* Analysis