A flaw was found in curl that allows a malicious TFTP server to confuse the transfer direction. By replying to a download request in a way that forces the client into transmit mode, the server can cause the curl client to send leftover sensitive data from previous operations on a reused connection handle. This unintended data transmission results in information disclosure.

The vulnerability affects the curl client application whenever it handles TFTP transfers. No specific build or version is listed, so all current releases of curl that support TFTP may be affected.

The CVSS score is 3.7, indicating a moderate severity. The EPSS score is not available and the issue is not included in CISA KEV. The likely attack vector requires an attacker to operate a rogue TFTP server that the client connects to. The exploit relies on a reused connection handle; if the client reuses a handle that previously transmitted sensitive data, that data can be sent back to the attacker. Consequently, while the overall risk is low to moderate, it can expose credentials or other confidential information.