CVE-2026-4873: connection reuse ignores TLS requirement
A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4873?
CVE-2026-4873 has a high severity rating due to the potential for sensitive data exposure over unencrypted connections.
How do I fix CVE-2026-4873?
To fix CVE-2026-4873, ensure that TLS is enforced for all connections and avoid reusing unencrypted connections.
What types of connections are affected by CVE-2026-4873?
CVE-2026-4873 affects connections made via IMAP, SMTP, and POP3 when TLS is required but incorrectly reused.
What are the potential consequences of exploiting CVE-2026-4873?
Exploiting CVE-2026-4873 can lead to sensitive information being intercepted due to clear-text communications.
Which versions of Curl are vulnerable to CVE-2026-4873?
Versions of Curl from 7.20.0 to 8.20.0 are vulnerable to CVE-2026-4873.