جزئیات آسیبپذیری
CVE-2026-92389
curl curl
TFTP direction confusion
CVSS 3.1
8.1بالا
شرح رسمی (انگلیسی)
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 8.1بالا | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
محصولات آسیبپذیر
| فروشنده | محصول | نسخهها | منبع |
|---|---|---|---|
| curl | curl | 7.15.0 ≤ v ≤ 7.15.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.15.1 ≤ v ≤ 7.15.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.15.2 ≤ v ≤ 7.15.2 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.15.3 ≤ v ≤ 7.15.3 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.15.4 ≤ v ≤ 7.15.4 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.15.5 ≤ v ≤ 7.15.5 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.16.0 ≤ v ≤ 7.16.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.16.1 ≤ v ≤ 7.16.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.16.2 ≤ v ≤ 7.16.2 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.16.3 ≤ v ≤ 7.16.3 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.16.4 ≤ v ≤ 7.16.4 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.17.0 ≤ v ≤ 7.17.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.17.1 ≤ v ≤ 7.17.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.18.0 ≤ v ≤ 7.18.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.18.1 ≤ v ≤ 7.18.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.18.2 ≤ v ≤ 7.18.2 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.19.0 ≤ v ≤ 7.19.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.19.1 ≤ v ≤ 7.19.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.19.2 ≤ v ≤ 7.19.2 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.19.3 ≤ v ≤ 7.19.3 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.19.4 ≤ v ≤ 7.19.4 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.19.5 ≤ v ≤ 7.19.5 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.19.6 ≤ v ≤ 7.19.6 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.19.7 ≤ v ≤ 7.19.7 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.20.0 ≤ v ≤ 7.20.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.20.1 ≤ v ≤ 7.20.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.21.0 ≤ v ≤ 7.21.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.21.1 ≤ v ≤ 7.21.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.21.2 ≤ v ≤ 7.21.2 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.21.3 ≤ v ≤ 7.21.3 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.21.4 ≤ v ≤ 7.21.4 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.21.5 ≤ v ≤ 7.21.5 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.21.6 ≤ v ≤ 7.21.6 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.21.7 ≤ v ≤ 7.21.7 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.22.0 ≤ v ≤ 7.22.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.23.0 ≤ v ≤ 7.23.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.23.1 ≤ v ≤ 7.23.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.24.0 ≤ v ≤ 7.24.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.25.0 ≤ v ≤ 7.25.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.26.0 ≤ v ≤ 7.26.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.27.0 ≤ v ≤ 7.27.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.28.0 ≤ v ≤ 7.28.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.28.1 ≤ v ≤ 7.28.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.29.0 ≤ v ≤ 7.29.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.30.0 ≤ v ≤ 7.30.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.31.0 ≤ v ≤ 7.31.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.32.0 ≤ v ≤ 7.32.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.33.0 ≤ v ≤ 7.33.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.34.0 ≤ v ≤ 7.34.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.35.0 ≤ v ≤ 7.35.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.36.0 ≤ v ≤ 7.36.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.37.0 ≤ v ≤ 7.37.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.37.1 ≤ v ≤ 7.37.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.38.0 ≤ v ≤ 7.38.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.39.0 ≤ v ≤ 7.39.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.40.0 ≤ v ≤ 7.40.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.41.0 ≤ v ≤ 7.41.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.42.0 ≤ v ≤ 7.42.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.42.1 ≤ v ≤ 7.42.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.43.0 ≤ v ≤ 7.43.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.44.0 ≤ v ≤ 7.44.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.45.0 ≤ v ≤ 7.45.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.46.0 ≤ v ≤ 7.46.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.47.0 ≤ v ≤ 7.47.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.47.1 ≤ v ≤ 7.47.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.48.0 ≤ v ≤ 7.48.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.49.0 ≤ v ≤ 7.49.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.49.1 ≤ v ≤ 7.49.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.50.0 ≤ v ≤ 7.50.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.50.1 ≤ v ≤ 7.50.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.50.2 ≤ v ≤ 7.50.2 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.50.3 ≤ v ≤ 7.50.3 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.51.0 ≤ v ≤ 7.51.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.52.0 ≤ v ≤ 7.52.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.52.1 ≤ v ≤ 7.52.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.53.0 ≤ v ≤ 7.53.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.53.1 ≤ v ≤ 7.53.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.54.0 ≤ v ≤ 7.54.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.54.1 ≤ v ≤ 7.54.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.55.0 ≤ v ≤ 7.55.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.55.1 ≤ v ≤ 7.55.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.56.0 ≤ v ≤ 7.56.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.56.1 ≤ v ≤ 7.56.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.57.0 ≤ v ≤ 7.57.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.58.0 ≤ v ≤ 7.58.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.59.0 ≤ v ≤ 7.59.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.60.0 ≤ v ≤ 7.60.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.61.0 ≤ v ≤ 7.61.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.61.1 ≤ v ≤ 7.61.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.62.0 ≤ v ≤ 7.62.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.63.0 ≤ v ≤ 7.63.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.64.0 ≤ v ≤ 7.64.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.64.1 ≤ v ≤ 7.64.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.65.0 ≤ v ≤ 7.65.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.65.1 ≤ v ≤ 7.65.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.65.2 ≤ v ≤ 7.65.2 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.65.3 ≤ v ≤ 7.65.3 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.66.0 ≤ v ≤ 7.66.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.67.0 ≤ v ≤ 7.67.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.68.0 ≤ v ≤ 7.68.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.69.0 ≤ v ≤ 7.69.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.69.1 ≤ v ≤ 7.69.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.70.0 ≤ v ≤ 7.70.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.71.0 ≤ v ≤ 7.71.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.71.1 ≤ v ≤ 7.71.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.72.0 ≤ v ≤ 7.72.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.73.0 ≤ v ≤ 7.73.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.74.0 ≤ v ≤ 7.74.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.75.0 ≤ v ≤ 7.75.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.76.0 ≤ v ≤ 7.76.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.76.1 ≤ v ≤ 7.76.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.77.0 ≤ v ≤ 7.77.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.78.0 ≤ v ≤ 7.78.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.79.0 ≤ v ≤ 7.79.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.79.1 ≤ v ≤ 7.79.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.80.0 ≤ v ≤ 7.80.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.81.0 ≤ v ≤ 7.81.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.82.0 ≤ v ≤ 7.82.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.83.0 ≤ v ≤ 7.83.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.83.1 ≤ v ≤ 7.83.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.84.0 ≤ v ≤ 7.84.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.85.0 ≤ v ≤ 7.85.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.86.0 ≤ v ≤ 7.86.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.87.0 ≤ v ≤ 7.87.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.88.0 ≤ v ≤ 7.88.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 7.88.1 ≤ v ≤ 7.88.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.0.0 ≤ v ≤ 8.0.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.0.1 ≤ v ≤ 8.0.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.1.0 ≤ v ≤ 8.1.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.1.1 ≤ v ≤ 8.1.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.1.2 ≤ v ≤ 8.1.2 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.10.0 ≤ v ≤ 8.10.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.10.1 ≤ v ≤ 8.10.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.11.0 ≤ v ≤ 8.11.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.11.1 ≤ v ≤ 8.11.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.12.0 ≤ v ≤ 8.12.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.12.1 ≤ v ≤ 8.12.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.13.0 ≤ v ≤ 8.13.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.14.0 ≤ v ≤ 8.14.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.14.1 ≤ v ≤ 8.14.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.15.0 ≤ v ≤ 8.15.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.16.0 ≤ v ≤ 8.16.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.17.0 ≤ v ≤ 8.17.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.18.0 ≤ v ≤ 8.18.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.19.0 ≤ v ≤ 8.19.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.2.0 ≤ v ≤ 8.2.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.2.1 ≤ v ≤ 8.2.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.20.0 ≤ v ≤ 8.20.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.21.0 ≤ v ≤ 8.21.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.22.0 ≤ v ≤ 8.22.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.3.0 ≤ v ≤ 8.3.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.4.0 ≤ v ≤ 8.4.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.5.0 ≤ v ≤ 8.5.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.6.0 ≤ v ≤ 8.6.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.7.0 ≤ v ≤ 8.7.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.7.1 ≤ v ≤ 8.7.1 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.8.0 ≤ v ≤ 8.8.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.9.0 ≤ v ≤ 8.9.0 | CVEProject cvelistV5 (CNA) |
| curl | curl | 8.9.1 ≤ v ≤ 8.9.1 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۳
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیبپذیریهای تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۷/۲۸
- آخرین بهروزرسانی
- ۱۴۰۵/۰۸/۰۸
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- curl
پیشبینی بهرهبرداری (EPSS)
۰٫۷۲٪
احتمال بهرهبرداری در ۳۰ روز
۵۴٪
صدک (نسبت به همهی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهرهبرداری
- اثبات مفهوم
- اثر فنی
- کامل
ضعفها (CWE)
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor