CVE-2026-4873

connection reuse ignores TLS requirement

View on CVE.org
Published May 13, 2026 CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability exists where a connection requiring TLS incorrectly reuses an
existing unencrypted connection from the same connection pool. If an initial
transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request
to that same host bypasses the TLS requirement and instead transmit data
unencrypted.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Ubuntu USN Ubuntu USN USN-8227-1 curl vulnerabilities
History
Type Values Removed Values Added
First Time appeared Haxx
Haxx curl
Weaknesses CWE-295
CPEs cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
Vendors & Products Haxx
Haxx curl
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}
Type Values Removed Values Added
References
Type Values Removed Values Added
Description A flaw was found in curl. A remote attacker could exploit this by initiating an unencrypted connection (via IMAP, SMTP, or POP3) and then making a subsequent request to the same host that requires Transport Layer Security (TLS). Due to incorrect connection reuse, the subsequent request would bypass the TLS requirement, leading to the transmission of sensitive information in cleartext. This vulnerability, categorized as Cleartext Transmission of Sensitive Information (CWE-319), results in information disclosure. A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.
Title curl: curl: Information disclosure due to incorrect TLS connection reuse connection reuse ignores TLS requirement
References
Type Values Removed Values Added
First Time appeared Curl
Curl curl
Vendors & Products Curl
Curl curl
Type Values Removed Values Added
Description A flaw was found in curl. A remote attacker could exploit this by initiating an unencrypted connection (via IMAP, SMTP, or POP3) and then making a subsequent request to the same host that requires Transport Layer Security (TLS). Due to incorrect connection reuse, the subsequent request would bypass the TLS requirement, leading to the transmission of sensitive information in cleartext. This vulnerability, categorized as Cleartext Transmission of Sensitive Information (CWE-319), results in information disclosure.
Title curl: curl: Information disclosure due to incorrect TLS connection reuse
Weaknesses CWE-319
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}

threat_severity

Moderate
Earlier changes (1)
Weaknesses

Sources

Status
PUBLISHED
Assigner
curl
Published
Updated
Sep 15, 2026, 6:02 AM
Reserved
Mar 26, 2026, 5:38 AM

View source JSON

Updated
May 13, 2026, 9:05 AM

JSON

Status
Modified
Published
May 13, 2026, 1:01 PM
Modified
Nov 11, 2026, 8:10 PM

View source JSON

Severity
Moderate
Public date
Apr 29, 2026, 12:00 AM

View source Bugzilla JSON

Updated
May 14, 2026, 3:30 PM

JSON