TFTP direction confusion
========================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-92389.html)

VULNERABILITY
-------------

libcurl's TFTP state machine fails to validate state transitions against the
requested transfer direction, accepting opening server responses for both
reads and writes interchangeably. A malicious TFTP server can respond to a
download request in a way that forces the client into transmit mode, prompting
libcurl to consume and transmit data from the handle's persistent
`CURLOPT_READDATA` pointer - including data remaining from unrelated prior
operations, such as an HTTP POST request executed on a reused handle.

INFO
----

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-92389 to this issue.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 7.15.0 to and including 8.22.0
- Not affected versions: curl < 7.15.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/56d9624b566ac15ffb4b4

libcurl is used by many applications, but not always advertised as such!

This flaw does not affect the curl command line tool.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/63dd390fab905a239a97e270

RECOMMENDATIONS
---------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Use fresh easy handles for TFTP

TIMELINE
--------

This issue was reported to the curl project on September 11, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Joshua Rogers (Aisle Research)
- Patched-by: Daniel Stenberg

Thanks a lot!