An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP
control connection that a previous easy handle upgraded with `STARTTLS` and
authenticated using a client certificate. The second handle performs neither a
new TLS handshake nor a new FTP login, so the server continues to authorize it
under the first handle's certificate identity.

* INFO

FTP transfers using client certificates are rare.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-86411 to this issue.

CWE-488: Exposure of Data Element to Wrong Session

Severity: Low

** AFFECTED VERSIONS

- Affected version: curl 8.21.0
- Not affected versions: curl < 8.21.0 and >= 8.22.0
- Introduced-in: https://github.com/curl/curl/commit/4ff212f8ed328fb95261e11a

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

** SOLUTION

- Fixed-in: https://github.com/curl/curl/commit/72352daba01ba8072b6c1c0254cb7

** TIMELINE

This issue was reported to the curl project on August 27, 2026.

curl 8.22.0 was released on September 2, 2026. This advisory was published on
October 14, 2026.

** CREDITS

- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Stefan Eissing

* Analysis