CVE-2026-92389

A flaw was found in curl. When handling Trivial File Transfer Protocol (TFTP) transfers, a malicious server can trigger information disclosure by responding to a download request in a way that forces the client into transmit mode. Consequently, the client may unintentionally send leftover sensitive data from prior operations on a reused connection handle to the attacker's server.

This vulnerability is evaluated with a Low severity impact for Red Hat products because exploitation depends on an unusual application architecture where a persistent library handle is reused across unrelated operations, such as an upload followed by a TFTP download from an untrusted server. The standard curl command-line utility is unaffected by this flaw. In standard enterprise deployments, TFTP usage is minimal and rarely shares connection handles with sensitive data transfers, limiting the potential blast radius to partial data exposure without enabling system modification or code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.