---
id: CVE-2026-92387
title: never-ending loop via server response omission
summary: |-
  By permanently omitting the final control-response line, a malicious FTP,
  IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its
  configured transfer timeout mechanism, indefinitely blocking all concurrent
  transfers boun…
severity: none
cwe:
  - CWE-835
vendor: curl
product: curl
affected:
  - curl >= 8.22.0 <= 8.22.0
  - curl >= 8.21.0 <= 8.21.0
  - curl >= 8.20.0 <= 8.20.0
  - curl >= 8.19.0 <= 8.19.0
  - curl >= 8.18.0 <= 8.18.0
  - curl >= 8.17.0 <= 8.17.0
  - curl >= 8.16.0 <= 8.16.0
  - curl >= 8.15.0 <= 8.15.0
  - curl >= 8.14.1 <= 8.14.1
  - curl >= 8.14.0 <= 8.14.0
  - curl >= 8.13.0 <= 8.13.0
  - curl >= 8.12.1 <= 8.12.1
  - curl >= 8.12.0 <= 8.12.0
  - curl >= 8.11.1 <= 8.11.1
  - curl >= 8.11.0 <= 8.11.0
  - curl >= 8.10.1 <= 8.10.1
  - curl >= 8.10.0 <= 8.10.0
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T20:19:14.672Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-92387'
references:
  - url: 'https://curl.se/docs/CVE-2026-92387.json'
    label: json
  - url: 'https://curl.se/docs/CVE-2026-92387.html'
    label: www
  - url: 'https://hackerone.com/reports/4022003'
    label: issue
tags:
  - cve.org
ingestedAt: '2026-10-20T21:19:21.284Z'
---

## Overview

By permanently omitting the final control-response line, a malicious FTP,
IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its
configured transfer timeout mechanism, indefinitely blocking all concurrent
transfers bound to the same multi-handle.

## Affected

- `curl >= 8.22.0 <= 8.22.0`
- `curl >= 8.21.0 <= 8.21.0`
- `curl >= 8.20.0 <= 8.20.0`
- `curl >= 8.19.0 <= 8.19.0`
- `curl >= 8.18.0 <= 8.18.0`
- `curl >= 8.17.0 <= 8.17.0`
- `curl >= 8.16.0 <= 8.16.0`
- `curl >= 8.15.0 <= 8.15.0`
- `curl >= 8.14.1 <= 8.14.1`
- `curl >= 8.14.0 <= 8.14.0`
- `curl >= 8.13.0 <= 8.13.0`
- `curl >= 8.12.1 <= 8.12.1`
- `curl >= 8.12.0 <= 8.12.0`
- `curl >= 8.11.1 <= 8.11.1`
- `curl >= 8.11.0 <= 8.11.0`
- `curl >= 8.10.1 <= 8.10.1`
- `curl >= 8.10.0 <= 8.10.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.