CVE-2026-4873 - Vulnerability Analysis

Overview

A mail client using IMAP, SMTP, or POP3 with connection pooling incorrectly reuses unencrypted connections for TLS-required requests, letting attackers intercept or manipulate data, exploit requires initial unencrypted connection.

Severity & Score

Impact

Attackers can intercept or manipulate sensitive data by bypassing TLS encryption, risking data confidentiality and integrity.

Mitigation

Update to the latest version that enforces TLS on all connections or disable connection reuse for TLS-required sessions.

References

• https://curl.se/docs/CVE-2026-4873.json
• https://hackerone.com/reports/3621851
• http://www.openwall.com/lists/oss-security/2026/04/29/7
• https://curl.se/docs/CVE-2026-4873.html

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner