{"id":"ALPINE-CVE-2026-86411","details":"An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity.","modified":"2026-10-25T16:30:03.601130830Z","published":"2026-10-20T20:17:25.533Z","upstream":["CVE-2026-86411"],"references":[{"type":"ADVISORY","url":"https://security.alpinelinux.org/vuln/CVE-2026-86411"}],"affected":[{"package":{"name":"curl","ecosystem":"Alpine:v3.23","purl":"pkg:apk/alpine/curl?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.23.0-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-86411.json"}},{"package":{"name":"curl","ecosystem":"Alpine:v3.24","purl":"pkg:apk/alpine/curl?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.23.0-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-86411.json"}}],"schema_version":"1.9.0"}