libcurl exhibits a flaw where, for a connection that requires TLS, the library may reuse an existing unencrypted connection from the same connection pool. When an initial transfer occurs in clear‑text through IMAP, SMTP, or POP3, a later request to that same host that should use TLS silently falls back to the unencrypted connection, transmitting data without encryption. This flaw corresponds to CWE-295 and CWE-319 and permits an attacker with network access to intercept otherwise protected traffic and disclose confidential data such as emails or credentials.

The vulnerability affects the libcurl library, the component used in many projects and system utilities for HTTP, HTTPS, and other protocols. No specific version range is disclosed in the advisory, indicating that all publicly available releases may potentially be impacted until a patch is applied.

The CVSS score of 5.9 places the issue in the medium severity range. The EPSS score of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote network access; an attacker must have the ability to initiate both an unencrypted and a TLS‑protected connection to the same host. If successful, the attacker can read the cleartext traffic, compromising confidentiality. The risk is therefore moderate, with the primary threat being exposure of sensitive data rather than full system compromise.