Is CVE-2026-92387 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92387 being exploited in the wild.

How severe is CVE-2026-92387?

Informational severity, published 20 October 2026.

Which products and versions are affected?

Curl 8.10.0 to 8.22.0; excludes 8.14.3 in 8.14.x, 8.16.2 in 8.16.x, 8.20.2 in 8.20.x.

Is there a fix for CVE-2026-92387?

Yes: fixed in 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch). Until then: Avoid using the ping-pong protocols (FTP, IMAP, SMTP, POP3) with libcurl if possible, or upgrade immediately. Note that the curl command-line tool is not affected by this flaw. [{"kind": "disclosed", "at": "2026-09-11", "note": "Issue reported to curl project"}, {"kind": "patched", "at": "2026-10-14", "note": "curl 8.23.0 released with fix"}, {"kind": "advisory", "at": "2026-10-14", "note": "CVE-2026-92387 published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92387 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-92387?

Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92387: curl infinite loop via server response omission

CVE-2026-92387 · Severity: info · Published 2026-10-20

libcurl is a widely-used library that applications depend on to fetch data over the internet using protocols like FTP, IMAP, POP3, and SMTP. A malicious server can omit the final response line, causing libcurl to enter an infinite loop that blocks all data transfers indefinitely and bypasses timeout protections. While exploitation requires a server feeding data at network speed to keep the client engaged, affected applications could become unresponsive.

Technologies: Curl. Vendors: Curl.

Quick answers

Is CVE-2026-92387 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92387 being exploited in the wild.
How severe is CVE-2026-92387?: Informational severity, published 20 October 2026.
Which products and versions are affected?: Curl 8.10.0 to 8.22.0; excludes 8.14.3 in 8.14.x, 8.16.2 in 8.16.x, 8.20.2 in 8.20.x.
Is there a fix for CVE-2026-92387?: Yes: fixed in 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch). Until then: Avoid using the ping-pong protocols (FTP, IMAP, SMTP, POP3) with libcurl if possible, or upgrade immediately. Note that the curl command-line tool is not affected by this flaw.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-11", "note": "Issue reported to curl project"}, {"kind": "patched", "at": "2026-10-14", "note": "curl 8.23.0 released with fix"}, {"kind": "advisory", "at": "2026-10-14", "note": "CVE-2026-92387 published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92387 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-92387?: Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch)

Avoid using the ping-pong protocols (FTP, IMAP, SMTP, POP3) with libcurl if possible, or upgrade immediately. Note that the curl command-line tool is not affected by this flaw.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-11", "note": "Issue reported to curl project"}, {"kind": "patched", "at": "2026-10-14", "note": "curl 8.23.0 released with fix"}, {"kind": "advisory", "at": "2026-10-14", "note": "CVE-2026-92387 published"}]

Technical details

The vulnerability is an infinite loop (CWE-835) in libcurl's protocol handlers for FTP, IMAP, POP3, and SMTP. By omitting the final control-response line, a malicious server prevents libcurl from detecting completion and exiting its read loop, bypassing the configured transfer timeout. Exploitation requires network-level conditions (a server maintaining data flow at read speed) but affects all concurrent transfers on the same multi-handle once triggered.

Affected products

curl curl 8.10.0 to 8.22.0; excludes 8.14.3 in 8.14.x, 8.16.2 in 8.16.x, 8.20.2 in 8.20.x

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.