AZL-109929
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109929.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-109929
- Upstream
- CVE-2026-92389
- Published
- 2026-10-20T21:17:21Z
- Modified
- 2026-10-23T14:17:14Z
- Summary
- CVE-2026-92389 affecting package cmake 3.30.3-15
- Details
-
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent
CURLOPT_READDATApointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle. - References