A flaw in libcurl allows a remote attacker to exploit a session reuse bug: the attacker initiates an unencrypted IMAP, SMTP, or POP3 connection and then performs a subsequent request to the same host that requires TLS. Because libcurl incorrectly reuses the connection, the TLS requirement is bypassed, and sensitive data is transmitted in cleartext. This is a Cleartext Transmission of Sensitive Information (CWE‑319) vulnerability that can lead to disclosure of confidential information such as emails, credentials, or other transmitted data.

The vulnerability affects the libcurl library, the component used in many projects and system utilities for HTTP, HTTPS, and other protocols. No specific version range is disclosed in the advisory, indicating that all publicly available releases may potentially be impacted until a patch is applied.

The CVSS score of 5.3 places the issue in the medium severity range. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote network access; an attacker must have the ability to initiate both an unencrypted and a TLS‑protected connection to the same host. If successful, the attacker can read the cleartext traffic, compromising confidentiality. The risk is therefore moderate, with the primary threat being exposure of sensitive data rather than full system compromise.