Description
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration
path meant for successful listings, leaving the write callback set to the
internal listing parser and the write callback data pointing directly to the
easy handle. Subsequent reuse of this handle triggers an immediate crash, and
cloning it via `curl_easy_duphandle()` copies this corrupted state into the
duplicate. If the original handle is subsequently freed, executing a transfer
on the cloned handle causes a heap use-after-free read against the dangling
handle reference; alternatively, reusing the original or cloned handle while
changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)
results in type confusion, forcing the internal parser to interpret incoming
server response bytes into memory at the application-supplied write data
pointer.
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8927-1 curl vulnerabilities
Ubuntu USN Ubuntu USN USN-8932-1 curl vulnerabilities
Ubuntu USN Ubuntu USN USN-8927-2 curl vulnerabilities
History

Tue, 20 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in curl. A remote malicious server can cause a Denial of Service (DoS) or memory corruption in applications that enable File Transfer Protocol (FTP) wildcard matching. When a wildcard listing operation fails, curl does not properly reset its internal callback handlers before the connection handle is reused or duplicated. An application that subsequently reuses or clones this corrupted handle may experience an immediate application crash or unsafe memory access. When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.
Title curl: curl: FTP wildcard write callback mixup FTP wildcard write callback mixup
References

Sun, 18 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Curl
Curl curl
Vendors & Products Curl
Curl curl

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in curl. A remote malicious server can cause a Denial of Service (DoS) or memory corruption in applications that enable File Transfer Protocol (FTP) wildcard matching. When a wildcard listing operation fails, curl does not properly reset its internal callback handlers before the connection handle is reused or duplicated. An application that subsequently reuses or clones this corrupted handle may experience an immediate application crash or unsafe memory access.
Title curl: curl: FTP wildcard write callback mixup
Weaknesses CWE-416
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H'}

threat_severity

Moderate

Subscriptions

Curl Curl
cve-icon MITRE

Status: PUBLISHED

Assigner: curl

Published:

Updated: 2026-10-20T20:20:41.220Z

Reserved: 2026-09-16T08:12:47.245Z

Link: CVE-2026-92388

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T21:17:21.243

Modified: 2026-10-20T21:17:21.243

Link: CVE-2026-92388

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-14T12:00:00Z

Links: CVE-2026-92388 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T22:45:17Z

Weaknesses