Is CVE-2026-4873 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4873 being exploited in the wild.

How severe is CVE-2026-4873?

Medium severity, with a CVSS score of 5.9, published 13 May 2026.

Which products and versions are affected?

curl curl 7.20.0 to 8.19.0; curl libcurl 7.20.0 to 8.19.0.

Is there a fix for CVE-2026-4873?

A patch was published on 2026-04-29: curl 8.20.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4873 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4873?

Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4873: A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool.

CVE-2026-4873 · Severity: medium · CVSS 5.9 · Published 2026-05-13

A vulnerability in the curl data transfer tool can cause sensitive information to be sent over the internet without encryption, even when a secure connection is requested. This occurs when the software incorrectly reuses an existing unencrypted connection for a new task that was supposed to be private. This could allow an attacker to intercept email credentials or message content during IMAP, POP3, or SMTP transfers.

Technologies: Haxx Curl. Vendors: Haxx.

Quick answers

Is CVE-2026-4873 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4873 being exploited in the wild.
How severe is CVE-2026-4873?: Medium severity, with a CVSS score of 5.9, published 13 May 2026.
Which products and versions are affected?: curl curl 7.20.0 to 8.19.0; curl libcurl 7.20.0 to 8.19.0.
Is there a fix for CVE-2026-4873?: A patch was published on 2026-04-29: curl 8.20.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4873 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4873?: Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logical flaw in curl's connection pool management allows a connection requiring TLS to incorrectly reuse an existing unencrypted connection. This issue specifically affects the IMAP, POP3, and SMTP protocols. If an initial transfer is performed in clear-text to a specific host, a subsequent request to the same host using the same credentials and protocol will bypass the TLS requirement and transmit data unencrypted. This vulnerability is tracked as CWE-319 (Cleartext Transmission of Sensitive Information) and was fixed in version 8.20.0.

Affected products

curl curl 7.20.0 to 8.19.0
curl libcurl 7.20.0 to 8.19.0

Timeline

2026-03-22: other: Reported to the curl project
2026-04-23: other: Distributions notified via Openwall
2026-04-29: patched: curl 8.20.0 released
2026-04-29: advisory: Project curl security advisory published
2026-05-13: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.