FTP connection reuse inherits client-certificate

{
  "id": "1a1d69c92167f5f0cc43d2524fb3b7a48c3a71124f4929ae35987c6dd8ab1236",
  "url": "https://osv.dev/vulnerability/CURL-CVE-2026-86411",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "FTP connection reuse inherits client-certificate",
    "summary": "An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.",
    "evidence": "osv:CURL-CVE-2026-86411",
    "products": [],
    "severity": "low",
    "structured": {
      "id": "CURL-CVE-2026-86411",
      "aliases": [
        "CURL-CVE-2026-86411",
        "CVE-2026-86411"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "8.21.0"
                },
                {
                  "fixed": "8.22.0"
                }
              ]
            },
            {
              "repo": "https://github.com/curl/curl.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "4ff212f8ed328fb95261e11add8f4d2f0616895a"
                },
                {
                  "fixed": "72352daba01ba8072b6c1c0254cb77860ed1ab06"
                }
              ]
            }
          ],
          "versions": [
            "8.21.0",
            "rc-8_22_0-3",
            "rc-8_22_0-2",
            "rc-8_22_0-1",
            "curl-8_21_0",
            "rc-8_21_0-3",
            "rc-8_21_0-2",
            "rc-8_21_0-1"
          ],
          "database_specific": {
            "source": "https://curl.se/docs/CURL-CVE-2026-86411.json",
            "vanir_signatures": [
              {
                "id": "CURL-CVE-2026-86411-15332d56",
                "digest": {
                  "length": 447,
                  "function_hash": "137408457246507356568929899392562883991"
                },
                "source": "https://github.com/curl/curl.git/commit/72352daba01ba8072b6c1c0254cb77860ed1ab06",
                "target": {
                  "file": "lib/url.c",
                  "function": "url_match_ssl_use"
                },
                "deprecated": false,
                "signature_type": "Function",
                "signature_version": "v1"
              },
              {
                "id": "CURL-CVE-2026-86411-1978bf57",
                "digest": {
                  "threshold": 0.9,
                  "line_hashes": [
                    "70148836786215020066010817017207029492",
                    "214623997824184722186061516736204732779",
                    "292579498451215313658478325050399342438",
                    "316184936108029474586670763707240004974"
                  ]
                },
                "source": "https://github.com/curl/curl.git/commit/72352daba01ba8072b6c1c0254cb77860ed1ab06",
                "target": {
                  "file": "lib/url.c"
                },
                "deprecated": false,
                "signature_type": "Line",
                "signature_version": "v1"
              }
            ],
            "vanir_signatures_modified": "2026-10-25T01:05:15Z"
          }
        }
      ],
      "modified": "2026-10-25T01:05:15.754822818Z",
      "provider": "osv",
      "references": [],
      "provider_metadata": {
        "CWE": {
          "id": "CWE-488",
          "desc": "Exposure of Data Element to Wrong Session"
        },
        "URL": "https://curl.se/docs/CVE-2026-86411.json",
        "www": "https://curl.se/docs/CVE-2026-86411.html",
        "issue": "https://hackerone.com/reports/3973190",
        "affects": "both",
        "package": "curl",
        "severity": "Low",
        "last_affected": "8.21.0"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-86411",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 444363,
  "published_at": "2026-10-14T08:00:00+00:00"
}