Executive brief
A vulnerability in the curl data transfer tool can cause sensitive information to be sent over the internet without encryption, even when a secure connection is requested. This occurs when the software incorrectly reuses an existing unencrypted connection for a new task that was supposed to be private. This could allow an attacker to intercept email credentials or message content during IMAP, POP3, or SMTP transfers.
Technical details
A logical flaw in curl's connection pool management allows a connection requiring TLS to incorrectly reuse an existing unencrypted connection. This issue specifically affects the IMAP, POP3, and SMTP protocols. If an initial transfer is performed in clear-text to a specific host, a subsequent request to the same host using the same credentials and protocol will bypass the TLS requirement and transmit data unencrypted. This vulnerability is tracked as CWE-319 (Cleartext Transmission of Sensitive Information) and was fixed in version 8.20.0.
Affected products
- curl curl 7.20.0 to 8.19.0
- curl libcurl 7.20.0 to 8.19.0
Timeline
- 2026-03-22: other: Reported to the curl project
- 2026-04-23: other: Distributions notified via Openwall
- 2026-04-29: patched: curl 8.20.0 released
- 2026-04-29: advisory: Project curl security advisory published
- 2026-05-13: disclosed: NVD publication date