CVE-2026-92387

A flaw was found in curl. When communicating with a malicious server using protocols such as FTP, IMAP, POP3, or SMTP, the server can trigger an infinite loop by continuously transmitting data while omitting the final control response line. This behavior bypasses configured transfer timeouts, indefinitely blocking concurrent transfers and resulting in a Denial of Service (DoS).

This vulnerability is rated as Low severity by Red Hat because successful exploitation requires connecting to an untrusted server under specific network throughput conditions and only results in denial of service for concurrent transfers. The standard curl command-line utility is unaffected, confining the flaw to applications utilizing libcurl asynchronous multi-handles. Additionally, the issue is limited to transactions using interactive protocols such as FTP, IMAP, POP3, or SMTP where an adversarial endpoint continuously streams data without final status terminators.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.