TFTP direction confusion
CVE-2026-92389 is fixed in 6 products on 1 platform, first by curl 7.58.0-2ubuntu3.24+esm15, released October 21, 2026. It is not reported as exploited. Patch Radar priority: Routine.
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| curl · Ubuntu 18.04.6 LTS (bionic) | 7.58.0-2ubuntu3.24+esm15 | curl 7.58.0-2ubuntu3.24+esm15 | Oct 21, 2026 |
| curl · Ubuntu 20.04 LTS (focal) | 7.68.0-1ubuntu2.25+esm10 | curl 7.68.0-1ubuntu2.25+esm10 | Oct 21, 2026 |
| curl · Ubuntu 22.04.1 LTS (jammy) | 7.81.0-1ubuntu1.30 | curl 7.81.0-1ubuntu1.30 | Oct 21, 2026 |
| curl · Ubuntu 24.04.5 LTS (noble) | 8.5.0-2ubuntu10.16 | curl 8.5.0-2ubuntu10.16 | Oct 21, 2026 |
| curl · Ubuntu 26.04.1 LTS (resolute) | 8.18.0-1ubuntu2.8 | curl 8.18.0-1ubuntu2.8 | Nov 7, 2026 |
| curl · sles 15.6 | 8.22.0-150600.4.58.1 | SUSE-SU-2026:5069-1 | Nov 7, 2026 |
| curl · sles 15.7 | 8.22.0-150700.7.33.1 | SUSE-SU-2026:5068-1 | Nov 7, 2026 |
| libcurl3-gnutls · Ubuntu 18.04.6 LTS (bionic) | 7.58.0-2ubuntu3.24+esm15 | libcurl3-gnutls 7.58.0-2ubuntu3.24+esm15 | Oct 21, 2026 |
| libcurl3-gnutls · Ubuntu 20.04 LTS (focal) | 7.68.0-1ubuntu2.25+esm10 | libcurl3-gnutls 7.68.0-1ubuntu2.25+esm10 | Oct 21, 2026 |
| libcurl3-gnutls · Ubuntu 22.04.1 LTS (jammy) | 7.81.0-1ubuntu1.30 | libcurl3-gnutls 7.81.0-1ubuntu1.30 | Oct 21, 2026 |
| libcurl3-nss · Ubuntu 18.04.6 LTS (bionic) | 7.58.0-2ubuntu3.24+esm15 | libcurl3-nss 7.58.0-2ubuntu3.24+esm15 | Oct 21, 2026 |
| libcurl3-nss · Ubuntu 20.04 LTS (focal) | 7.68.0-1ubuntu2.25+esm10 | libcurl3-nss 7.68.0-1ubuntu2.25+esm10 | Oct 21, 2026 |
| libcurl3-nss · Ubuntu 22.04.1 LTS (jammy) | 7.81.0-1ubuntu1.30 | libcurl3-nss 7.81.0-1ubuntu1.30 | Oct 21, 2026 |
| libcurl3t64-gnutls · Ubuntu 24.04.5 LTS (noble) | 8.5.0-2ubuntu10.16 | libcurl3t64-gnutls 8.5.0-2ubuntu10.16 | Oct 21, 2026 |
| libcurl3t64-gnutls · Ubuntu 26.04.1 LTS (resolute) | 8.18.0-1ubuntu2.8 | libcurl3t64-gnutls 8.18.0-1ubuntu2.8 | Nov 7, 2026 |
| libcurl4 · Ubuntu 18.04.6 LTS (bionic) | 7.58.0-2ubuntu3.24+esm15 | libcurl4 7.58.0-2ubuntu3.24+esm15 | Oct 21, 2026 |
| libcurl4 · Ubuntu 20.04 LTS (focal) | 7.68.0-1ubuntu2.25+esm10 | libcurl4 7.68.0-1ubuntu2.25+esm10 | Oct 21, 2026 |
| libcurl4 · Ubuntu 22.04.1 LTS (jammy) | 7.81.0-1ubuntu1.30 | libcurl4 7.81.0-1ubuntu1.30 | Oct 21, 2026 |
| libcurl4t64 · Ubuntu 24.04.5 LTS (noble) | 8.5.0-2ubuntu10.16 | libcurl4t64 8.5.0-2ubuntu10.16 | Oct 21, 2026 |
| libcurl4t64 · Ubuntu 26.04.1 LTS (resolute) | 8.18.0-1ubuntu2.8 | libcurl4t64 8.18.0-1ubuntu2.8 | Nov 7, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.