{"id":"CURL-CVE-2026-86411","summary":"FTP connection reuse inherits client-certificate","details":"An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity.","aliases":["CVE-2026-86411"],"modified":"2026-10-14T19:02:55.551707660Z","published":"2026-10-14T08:00:00Z","database_specific":{"package":"curl","affects":"both","URL":"https://curl.se/docs/CVE-2026-86411.json","www":"https://curl.se/docs/CVE-2026-86411.html","issue":"https://hackerone.com/reports/3973190","CWE":{"id":"CWE-488","desc":"Exposure of Data Element to Wrong Session"},"last_affected":"8.21.0","severity":"Low"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"8.21.0"},{"fixed":"8.22.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"4ff212f8ed328fb95261e11add8f4d2f0616895a"},{"fixed":"72352daba01ba8072b6c1c0254cb77860ed1ab06"}]}],"versions":["8.21.0","rc-8_22_0-3","rc-8_22_0-2","rc-8_22_0-1","curl-8_21_0","rc-8_21_0-3","rc-8_21_0-2","rc-8_21_0-1"],"database_specific":{"vanir_signatures_modified":"2026-10-14T19:02:55Z","source":"https://curl.se/docs/CURL-CVE-2026-86411.json","vanir_signatures":[{"deprecated":false,"digest":{"length":447,"function_hash":"137408457246507356568929899392562883991"},"id":"CURL-CVE-2026-86411-15332d56","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/72352daba01ba8072b6c1c0254cb77860ed1ab06","target":{"function":"url_match_ssl_use","file":"lib/url.c"}},{"deprecated":false,"digest":{"line_hashes":["70148836786215020066010817017207029492","214623997824184722186061516736204732779","292579498451215313658478325050399342438","316184936108029474586670763707240004974"],"threshold":0.9},"id":"CURL-CVE-2026-86411-1978bf57","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/72352daba01ba8072b6c1c0254cb77860ed1ab06","target":{"file":"lib/url.c"}}]}}],"schema_version":"1.9.0","credits":[{"name":"Stanislav Fort (Aisle Research)","type":"FINDER"},{"name":"Stefan Eissing","type":"REMEDIATION_DEVELOPER"}]}