CVE-2026-4873

A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.

Affected products

Linuxmint, Red Os, Ubuntu, Curl

Haxx Curl

< 8.20.0

CVSS 3.1

5.9 MEDIUM

EPSS

0.3% (25th percentile)

Weakness

CWE-319, CWE-295

NVD status

Analyzed

Published

2026-05-13

No exploit for CVE-2026-4873 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.