[ADVISORY] curl: CVE-2026-4873: connection reuse ignores TLS requirement

[Daniel Stenberg <daniel () haxx se>]

connection reuse ignores TLS requirement
========================================

Project curl Security Advisory, April 29 2026
[Permalink](https://curl.se/docs/CVE-2026-4873.html)

VULNERABILITY
-------------

A vulnerability exists where a connection requiring TLS incorrectly reuses an
existing unencrypted connection from the same connection pool. If an initial
transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request
to that same host will bypass the TLS requirement and instead transmit data
unencrypted.

INFO
----

This flaw requires a rather special series of events to trigger. Such a series
is unlikely to be used much in the wild.

This issue only happens for transfers done using `IMAP://`, `POP3://` or
`SMTP://` URL schemes. The initial transfer and the second transfer both need
to be done to the same host, use the same credentials and the same URL
schemes. The login and the initial transfer is done over clear-text, so the
user is obviously already accepting an insecure transmission for this. This
flaw still makes it worse as the second transfer is intended to be secured by
TLS but is not.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-4873 to this issue.

CWE-319: Cleartext Transmission of Sensitive Information

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 7.20.0 to and including 8.19.0
- Not affected versions: curl < 7.20.0 and >= 8.20.0
- Introduced-in: https://github.com/curl/curl/commit/ec3bb8f727405642a

libcurl is used by many applications, but not always advertised as such!

This bug is not considered a *C mistake*. It is not likely to have been
avoided had we not been using C.

This flaw also affects the curl command line tool.

SOLUTION
--------

curl 8.20.0 fixes this logical flaw

- Fixed-in: https://github.com/curl/curl/commit/507e7be573b0a76fca597b75

RECOMMENDATIONS
---------------

We suggest you take one of the following actions immediately, in order of
preference:

 A - Upgrade to curl and libcurl 8.20.0

 B - Apply the patch and rebuild libcurl

 C - Do not use clear-text IMAP/POP3/SMTP transfers

TIMELINE
---------

It was reported to the curl project on March 22nd 2026. We contacted
distros@openwall on April 23.

libcurl 8.20.0 was released on April 29th 2026, coordinated with the
publication of this advisory.

CREDITS
-------

- Reported-by: Arkadi Vainbrand
- Patched-by: Daniel Stenberg

Thanks a lot!

--

 / daniel.haxx.se || https://rock-solid.curl.dev