Bug 2550692 (CVE-2026-92388)

Summary:	CVE-2026-92388 curl: curl: FTP wildcard write callback mixup
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, anthomas, aos-team-art-private, asdas, csutherl, dpaolell, ehelms, ggainey, jclere, jdelft, jpasqual, jupierce, juwatts, lgarciaa, mbiarnes, mdellweg, mhulan, nmoumoul, osousa, pcreech, pjindal, plodge, ppalepu, ppostler, prdhamdh, rchan, rekumar, rhel-process-autobot, security-response-team, sghai, sidsharm, smallamp, suppawar, szappis, tmalecek, vchlup, vlaad, vvoronko, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in curl. A remote malicious server can cause a Denial of Service (DoS) or memory corruption in applications that enable File Transfer Protocol (FTP) wildcard matching. When a wildcard listing operation fails, curl does not properly reset its internal callback handlers before the connection handle is reused or duplicated. An application that subsequently reuses or clones this corrupted handle may experience an immediate application crash or unsafe memory access.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-10-14

Description OSIDB Bzimport 2026-10-13 16:55:42 UTC

FTP wildcard write callback mixup
=================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-92388.html)

VULNERABILITY
-------------

When an FTP wildcard `LIST` operation fails, libcurl omits the restoration
path meant for successful listings, leaving the write callback set to the
internal listing parser and the write callback data pointing directly to the
easy handle. Subsequent reuse of this handle triggers an immediate crash, and
cloning it via `curl_easy_duphandle()` copies this corrupted state into the
duplicate. If the original handle is subsequently freed, executing a transfer
on the cloned handle causes a heap use-after-free read against the dangling
handle reference; alternatively, reusing the original or cloned handle while
reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)
results in type confusion, forcing the internal parser to interpret incoming
server response bytes into memory at the application-supplied write data
pointer.

INFO
----

This flaw needs `CURLOPT_FTP_WILDCARD` enabled to trigger.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-92388 to this issue.

CWE-416: Use After Free

Severity: Low

This bug is considered a *C mistake* (likely to have been avoided had we not
been using C).

AFFECTED VERSIONS
-----------------

- Affected versions: curl 7.21.0 to and including 8.22.0
- Not affected versions: curl < 7.21.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/0825cd80a62c21725fb

libcurl is used by many applications, but not always advertised as such!

This flaw does not affect the curl command line tool.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/ba8f8a7f27a5c5e19e4ef212
  and https://github.com/curl/curl/commit/b85acacec9b38442741bb019bc9

RECOMMENDATIONS
---------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Never reuse easy handles for or after FTP wildcard matches

TIMELINE
--------

This issue was reported to the curl project on September 11, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Joshua Rogers (Aisle Research)
- Patched-by: Daniel Stenberg

Thanks a lot!