{"id":"CURL-CVE-2026-92387","summary":"never-ending loop via server response omission","details":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle.","aliases":["CVE-2026-92387"],"modified":"2026-10-14T07:04:26.613570306Z","published":"2026-10-14T08:00:00Z","database_specific":{"affects":"both","URL":"https://curl.se/docs/CVE-2026-92387.json","www":"https://curl.se/docs/CVE-2026-92387.html","issue":"https://hackerone.com/reports/4022003","CWE":{"id":"CWE-835","desc":"Loop with Unreachable Exit Condition ('Infinite Loop')"},"last_affected":"8.22.0","severity":"Low","package":"curl"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"8.10.0"},{"fixed":"8.23.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"a5598b6fcb9ec6b57a7770939a0ffb004456f333"},{"fixed":"753735af87f5c30cb6f60a70342f8bc4bc5fd5db"}]}],"versions":["8.22.0","8.21.0","8.20.0","8.19.0","8.18.0","8.17.0","8.16.0","8.15.0","8.14.1","8.14.0","8.13.0","8.12.1","8.12.0","8.11.1","8.11.0","8.10.1","8.10.0","curl-8_22_0","rc-8_22_0-3","rc-8_22_0-2","rc-8_22_0-1","curl-8_21_0","rc-8_21_0-3","rc-8_21_0-2","rc-8_21_0-1","curl-8_20_0","rc-8_20_0-3","rc-8_20_0-2","rc-8_20_0-1","curl-8_19_0","rc-8_19_0-3","rc-8_19_0-2","rc-8_19_0-1","curl-8_18_0","rc-8_18_0-3","rc-8_18_0-2","rc-8_18_0-1","curl-8_17_0","curl-8_16_0","curl-8_15_0","curl-8_14_1","curl-8_14_0","curl-8_13_0","curl-8_12_1","curl-8_12_0","curl-8_11_1","curl-8_11_0","curl-8_10_1","curl-8_10_0"],"database_specific":{"source":"https://curl.se/docs/CURL-CVE-2026-92387.json","vanir_signatures":[{"deprecated":false,"digest":{"length":1871,"function_hash":"93901083509750780320854330073705313769"},"id":"CURL-CVE-2026-92387-9e19c6ef","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/753735af87f5c30cb6f60a70342f8bc4bc5fd5db","target":{"file":"lib/pingpong.c","function":"Curl_pp_readresp"}},{"digest":{"line_hashes":["169611561849356060343441831226630819355","118885270056145985855100001206482147825","176955460389398393301350962022688380839","152937119064837621797053374591284717795","325734690655925500675941255108677679434","255149461833275457707710178384217140142","309957915722649277253297686296249982562","228368724181808616248373136079572392417"],"threshold":0.9},"id":"CURL-CVE-2026-92387-d9a0166d","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/753735af87f5c30cb6f60a70342f8bc4bc5fd5db","target":{"file":"lib/pingpong.c"},"deprecated":false}],"vanir_signatures_modified":"2026-10-14T07:04:26Z"}}],"schema_version":"1.9.0","credits":[{"name":"Joshua Rogers (Aisle Research)","type":"FINDER"},{"name":"Daniel Stenberg","type":"REMEDIATION_DEVELOPER"}]}