Bug 2550691 (CVE-2026-92387)

Summary:	CVE-2026-92387 curl: curl: never-ending loop via server response omission
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	anthomas, csutherl, ehelms, ggainey, jclere, jpasqual, juwatts, mdellweg, mhulan, nmoumoul, osousa, pcreech, pjindal, plodge, rchan, rekumar, rhel-process-autobot, security-response-team, smallamp, szappis, tmalecek, vchlup, vvoronko, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in curl. When communicating with a malicious server using protocols such as FTP, IMAP, POP3, or SMTP, the server can trigger an infinite loop by continuously transmitting data while omitting the final control response line. This behavior bypasses configured transfer timeouts, indefinitely blocking concurrent transfers and resulting in a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-10-14

Description OSIDB Bzimport 2026-10-13 16:48:46 UTC

never-ending loop via server response omission
==============================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-92387.html)

VULNERABILITY
-------------

By permanently omitting the final control-response line, a malicious FTP,
IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its
configured transfer timeout mechanism, indefinetly blocking all concurrent
transfers bound to the same multi-handle.

INFO
----

To keep libcurl "locked" in this loop, it requires that the server can feed
the data to the client at read speed, meaning a very high network speed or an
unusually slow client.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-92387 to this issue.

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 8.10.0 to and including 8.22.0
- Not affected versions: curl < 8.10.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/a5598b6fcb9ec6b57a77

libcurl is used by many applications, but not always advertised as such!

This flaw does not affect the curl command line tool.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/753735af87f5c30cb6f60a7

RECOMMENDATIONS
---------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Avoid using the pingpong protocols

TIMELINE
--------

This issue was reported to the curl project on September 11, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Joshua Rogers (Aisle Research)
- Patched-by: Daniel Stenberg

Thanks a lot!