libcurl Timeout Bypass via Omitted Control-Response in FTP/IMAP/POP3/SMTP
CVE-2026-92387 Published on October 20, 2026
never-ending loop via server response omission
By permanently omitting the final control-response line, a malicious FTP,
IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its
configured transfer timeout mechanism, indefinitely blocking all concurrent
transfers bound to the same multi-handle.
Vulnerability Analysis
CVE-2026-92387 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-92387. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is an Infinite Loop Vulnerability?
The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
CVE-2026-92387 has been classified to as an Infinite Loop vulnerability or weakness.
Products Associated with CVE-2026-92387
stack.watch emails you whenever new vulnerabilities are published in Canonical Ubuntu Linux or Haxx Curl. Just hit a watch button to start following.
