A flaw in curl allows a malicious server that speaks FTP, IMAP, POP3, or SMTP to force an infinite loop in the client by repeatedly sending data but never sending the final control response line. The loop bypasses any configured transfer timeouts and keeps the client blocked while the bad server continues to transmit, ultimately denying service to any additional concurrent transfers. This is an instance of CWE-835 Infinite Loop behavior where a loop has no exit condition and can be exploited to exhaust system resources.

Users of the curl command‑line tool or libcurl library are affected. The vulnerability is present in the version(s) that include the loop‑handling logic for the aforementioned protocols; specific version ranges are not listed in the data. Any environment that uses curl to communicate with external FTP, IMAP, POP3, or SMTP servers could be impacted.

The CVSS score of 3.7 indicates a low overall severity, but the effect of the flaw is that a single malicious server can completely halt all data transfers, which can be significant for automated backup or synchronization processes. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not been observed yet. The most likely attack vector is a remote malicious server that an infected or legitimate client connects to; the attacker requires only the ability to send data to the client over one of the supported protocols. Thus, while the impact is limited to denial of service, precautions should still be taken to mitigate the risk.