# CVE-2026-92389: libcurl TFTP direction confusion

Source: https://junglewise.ai/threats/cve-2026-92389-libcurl-s-tftp-state-machine-fails-to-validate-state-transitions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-92389 · Severity: info · Published 2026-10-20

libcurl is a widely-used library that handles data transfer over multiple protocols including TFTP. A flaw in TFTP state validation allows a malicious TFTP server to trick a client into sending data in the wrong direction. An attacker can force libcurl to leak sensitive data from prior unrelated operations, such as credentials or payload data from a previous HTTP POST request on a reused connection.

Technologies: [Curl Libcurl](https://junglewise.ai/threats/technologies/curl-libcurl). Vendors: [Curl](https://junglewise.ai/threats/vendors/curl).

## Quick answers

**Is CVE-2026-92389 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92389 being exploited in the wild.

**How severe is CVE-2026-92389?** Informational severity, published 20 October 2026.

**Which products and versions are affected?** Curl Libcurl 7.15.0 to 8.22.0.

**Is there a fix for CVE-2026-92389?** Yes: fixed in libcurl 8.23.0, 8.20.2 (in 8.20.x branch), 8.16.2 (in 8.16.x branch), 8.14.3 (in 8.14.x branch). Until then: Use fresh easy handles for each TFTP operation instead of reusing the same handle across multiple protocols or transfers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92389 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92389?** Check whether you run Curl Libcurl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in libcurl 8.23.0, 8.20.2 (in 8.20.x branch), 8.16.2 (in 8.16.x branch), 8.14.3 (in 8.14.x branch)

Use fresh easy handles for each TFTP operation instead of reusing the same handle across multiple protocols or transfers.

## Technical details

The vulnerability exists in libcurl's TFTP state machine, which fails to validate that opening server responses match the requested transfer direction (read vs. write). A malicious TFTP server responding to a download request can force the client into transmit mode, causing it to send data from the persistent CURLOPT_READDATA buffer—potentially exposing leftover data from prior requests on a reused handle. The flaw affects libcurl versions 7.15.0 through 8.22.0 (with patched branches at 8.14.3, 8.16.2, and 8.20.2), and has been fixed in version 8.23.0.

## Affected products

- curl libcurl 7.15.0 to 8.22.0

## Timeline

- 2026-09-11: disclosed
- 2026-10-14: patched
- 2026-10-14: advisory

## References

- [https://curl.se/docs/CVE-2026-92389.html](https://curl.se/docs/CVE-2026-92389.html)
- [https://curl.se/docs/CVE-2026-92389.json](https://curl.se/docs/CVE-2026-92389.json)

## Related threats

- [curl FTP wildcard write callback mixup](https://junglewise.ai/threats/cve-2026-92388-when-an-ftp-wildcard-list-operation-fails-libcurl-omits-the)
- [curl auto client cert connection reuse mixup](https://junglewise.ai/threats/cve-2026-86415-libcurl-s-connection-cache-match-function-never-considers-the)