curl contains a flaw that permits an attacker to perform actions under an unauthorized identity when an unencrypted FTP transfer reuses a connection that was previously authenticated with a client certificate and upgraded with TLS. Because curl omits a new handshake or re-authentication when reusing the pooled connection, the subsequent transfer inherits the prior session’s credentials, enabling the attacker to carry out operations on the remote server that they should not be authorized to perform. This weakness can lead to unauthorized file access, modification, or other privileged actions on the target FTP server.

The vulnerability affects the curl utility, specifically versions where session reuse handling is implemented for FTP over TLS; the exact release numbers are not disclosed in the available data. Any system using curl to connect to an FTP server with client‑certificate authentication over TLS and that subsequently reuses the connection for plain FTP may be impacted.

The CVSS score of 5.9 indicates a moderate risk. The EPSS score is unknown, and the vulnerability is not listed in CISA’s KEV catalog. The attack likely occurs through network traffic where an attacker can force the reuse of an FTP session, such as by setting up a malicious FTP proxy or manipulating the client to reuse a pooled connection. An attacker would need network access to influence the connection path, but no user interaction or elevated privileges on the client side are required once the reuse is triggered.