The vulnerability arises when a server for FTP, IMAP, POP3, or SMTP omits a required control‑response line, causing libcurl to enter an infinite loop. This loop bypasses the client’s transfer timeout settings, keeping the client blocked indefinitely and preventing any additional concurrent transfers from completing. The flaw directly leads to a denial‑of‑service condition for applications that use libcurl to perform multiple network transfers.

Users of the curl command‑line tool or libcurl library are affected. The vulnerability is present in the version(s) that include the loop‑handling logic for the aforementioned protocols; specific version ranges are not listed in the data. Any environment that uses curl to communicate with external FTP, IMAP, POP3, or SMTP servers could be impacted.

The CVSS score of 8.1 indicates a high overall severity, but the effect of the flaw is that a single malicious server can completely halt all data transfers, which can be significant for automated backup or synchronization processes. The EPSS score indicates a very low probability of exploitation (<1%) and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not been observed yet. The most likely attack vector is a remote malicious server that an infected or legitimate client connects to; the attacker requires only the ability to send data to the client over one of the supported protocols. Thus, while the impact is limited to denial of service, precautions should still be taken to mitigate the risk.