# CVE-2026-4873: A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool.

Source: https://junglewise.ai/threats/cve-2026-4873-curl-connection-reuse-ignores-tls-requirement-in-email-protocols  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-4873 · Severity: medium · CVSS 5.9 · Published 2026-05-13

A vulnerability in the curl data transfer tool can cause sensitive information to be sent over the internet without encryption, even when a secure connection is requested. This occurs when the software incorrectly reuses an existing unencrypted connection for a new task that was supposed to be private. This could allow an attacker to intercept email credentials or message content during IMAP, POP3, or SMTP transfers.

Technologies: [Haxx Curl](https://junglewise.ai/threats/technologies/curl). Vendors: [Haxx](https://junglewise.ai/threats/vendors/haxx).

## Quick answers

**Is CVE-2026-4873 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4873 being exploited in the wild.

**How severe is CVE-2026-4873?** Medium severity, with a CVSS score of 5.9, published 13 May 2026.

**Which products and versions are affected?** curl curl 7.20.0 to 8.19.0; curl libcurl 7.20.0 to 8.19.0.

**Is there a fix for CVE-2026-4873?** A patch was published on 2026-04-29: curl 8.20.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4873 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4873?** Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A logical flaw in curl's connection pool management allows a connection requiring TLS to incorrectly reuse an existing unencrypted connection. This issue specifically affects the IMAP, POP3, and SMTP protocols. If an initial transfer is performed in clear-text to a specific host, a subsequent request to the same host using the same credentials and protocol will bypass the TLS requirement and transmit data unencrypted. This vulnerability is tracked as CWE-319 (Cleartext Transmission of Sensitive Information) and was fixed in version 8.20.0.

## Affected products

- curl curl 7.20.0 to 8.19.0
- curl libcurl 7.20.0 to 8.19.0

## Timeline

- 2026-03-22: other: Reported to the curl project
- 2026-04-23: other: Distributions notified via Openwall
- 2026-04-29: patched: curl 8.20.0 released
- 2026-04-29: advisory: Project curl security advisory published
- 2026-05-13: disclosed: NVD publication date

## References

- [https://curl.se/docs/CVE-2026-4873.html](https://curl.se/docs/CVE-2026-4873.html)
- [https://curl.se/docs/CVE-2026-4873.json](https://curl.se/docs/CVE-2026-4873.json)
- [https://hackerone.com/reports/3621851](https://hackerone.com/reports/3621851)
- [http://www.openwall.com/lists/oss-security/2026/04/29/7](http://www.openwall.com/lists/oss-security/2026/04/29/7)

## Related threats

- [curl Public Suffix List domain boundary check bypass in cookie handling](https://junglewise.ai/threats/cve-2026-82209-curl-public-suffix-list-domain-boundary-check-bypass-in-cookie)
- [curl libcurl certificate validation bypass in wolfSSL backend](https://junglewise.ai/threats/cve-2026-82208-curl-libcurl-certificate-validation-bypass-in-wolfssl-backend)
- [curl secure cookie attribute bypass with tab](https://junglewise.ai/threats/cve-2026-80255-curl-secure-cookie-attribute-bypass-with-tab)
- [curl HTTPS connection reuse with mismatched CA store settings](https://junglewise.ai/threats/cve-2026-80231-curl-https-connection-reuse-with-mismatched-ca-store-settings)
- [curl public key pinning bypass with disabled peer verification](https://junglewise.ai/threats/cve-2026-80230-curl-public-key-pinning-bypass-with-disabled-peer-verification)