never-ending loop via server response omission
==============================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-92387.html)

VULNERABILITY
-------------

By permanently omitting the final control-response line, a malicious FTP,
IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its
configured transfer timeout mechanism, indefinetly blocking all concurrent
transfers bound to the same multi-handle.

INFO
----

To keep libcurl "locked" in this loop, it requires that the server can feed
the data to the client at read speed, meaning a very high network speed or an
unusually slow client.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-92387 to this issue.

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 8.10.0 to and including 8.22.0
- Not affected versions: curl < 8.10.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/a5598b6fcb9ec6b57a77

libcurl is used by many applications, but not always advertised as such!

This flaw does not affect the curl command line tool.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/753735af87f5c30cb6f60a7

RECOMMENDATIONS
---------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Avoid using the pingpong protocols

TIMELINE
--------

This issue was reported to the curl project on September 11, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Joshua Rogers (Aisle Research)
- Patched-by: Daniel Stenberg

Thanks a lot!