CVE-2026-86411
NONE—CVSS v3
—CVSS v2
0.14%
EPSS (exploit probability)
—CWE
Description
An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP
control connection that a previous easy handle upgraded with `STARTTLS` and
authenticated using a client certificate. The second handle performs neither a
new TLS handshake nor a new FTP login, so the server continues to authorize it
under the first handle's certificate identity.
Affected routers (0)
No routers currently mapped to this CVE in our database.