GHSA-533v-mrfx-494rCriticalCVSS 9.1

An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection...

Published
October 20, 2026
Last Modified
October 29, 2026

🔗 CVE IDs covered (1)

📋 Description

An ftp:// transfer configured with CURLUSESSL_NONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.

🔗 References (5)