CVE WATCH / VULNERABILITY DETAIL
CVE-2026-92389
UNKNOWNCVSS 0NVD feed
Published 20 October 2026 · tracked since 21 October 2026
Description
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, promp
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog