CVE-2026-92389 TFTP direction confusion

Not scored Published 20 Oct 2026 Updated 20 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-92389?

CVE-2026-92389 is a vulnerability in curl, published on 20 Oct 2026.

Official description

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.

Which versions are affected by CVE-2026-92389?

How do I fix CVE-2026-92389?

Upgrade to a fixed version.

Is CVE-2026-92389 being exploited?

There is no known exploitation of CVE-2026-92389 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2026-92389, AZL-109929, AZL-109950, AZL-110013, AZL-110190, AZL-110235 and 8 more.