Curl 7.21.0 < 8.23.0 FTP Wildcard Use-After-Free

high Nessus Plugin ID 371154

Language:

Synopsis

The remote host has a program that is affected by a use-after-free vulnerability.

Description

The version of curl installed on the remote host is 7.21.0 prior to 8.23.0. It is, therefore, affected by a use-after-free vulnerability:

- When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via curl_easy_duphandle() copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference;
alternatively, reusing the original or cloned handle while changing only CURLOPT_WRITEDATA (and omitting CURLOPT_WRITEFUNCTION) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer. (CVE-2026-92388)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade Curl to version 8.23.0 or later.

Plugin Details

Severity: High

ID: 371154

File Name: curl_CVE-2026-92388.nasl

Version: 1.1

Type: Local

Agent: windows, macosx, unix

Family: Misc.

Published: 10/23/2026

Updated: 10/23/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

CVSS Score Rationale: Score from an analysis done by tenable

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.52

CVSS v3

Risk Factor: High

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability Information

CPE: cpe:/a:haxx:curl

Required KB Items: installed_sw/Curl

Patch Publication Date: 10/14/2026

Vulnerability Publication Date: 10/14/2026

Reference Information

CVE: CVE-2026-92388

IAVA: 2026-A-1143

Detections

Analytics