Executive brief
A vulnerability in the curl data transfer tool could allow the software to incorrectly reuse an existing network connection for a new request, even if the security settings for the new request are different. This occurs when using protocols like email (IMAP, POP3, SMTP) or file transfer (FTP) that start in plain text and upgrade to encrypted communication via STARTTLS. In practice, this could lead to data being sent over a connection that does not meet the intended security or encryption requirements.
Technical details
A logical flaw exists in curl's connection reuse mechanism for protocols that utilize STARTTLS (IMAP, POP3, SMTP, FTP, and LDAP). When a new transfer is initiated that requires a STARTTLS upgrade, the validation logic intended to ensure TLS configuration consistency between the new transfer and an existing live connection is bypassed. Consequently, curl may reuse a connection that does not match the desired TLS parameters, potentially leading to improper certificate validation or weakened security posture. The issue is fixed in version 8.21.0 by ensuring configuration checks are performed during the STARTTLS upgrade path.
Affected products
- curl curl 7.30.0 to 8.20.0
- curl libcurl 7.30.0 to 8.20.0
Timeline
- 2026-05-06: disclosed: Reported to the curl project via HackerOne
- 2026-06-17: other: Contacted distros@openwall
- 2026-06-24: patched: Fixed in curl 8.21.0
- 2026-06-24: advisory: Project curl security advisory published