Examples / Report #3621851 Saved analysis

CVE-2026-4873: connection reuse ignores TLS requirement

curl · 2026-03-225.7s analysis · $0.007 in model calls

What the report claims

Connection reuse for cleartext mail protocols ignores the later transfer's CURLOPT_USE_SSL, allowing a TLS-required transfer to reuse a plaintext connection.

Compare with curl's recorded outcome

Known vulnerability

A real vulnerability: CVE-2026-4873 connection reuse ignores TLS requirement

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

More detail needed

There is not enough information to verify the reported bug.

Why this finding?

No curl source code was provided for the relevant connection reuse logic (likely in lib/conncache.c, lib/urlapi.c, or protocol-specific files)
Cannot verify whether CURLOPT_USE_SSL is included in connection matching criteria
Cannot verify protocol-specific handling for SMTP, POP3, IMAP cleartext-upgrade paths
All claims are not_verifiable due to missing code

What still needs checking

curl source code for connection reuse logic (lib/conncache.c, lib/urlapi.c, lib/smtp.c, lib/pop3.c, lib/imap.c) at revision 9820e5dface5
Specifically the code that builds the connection reuse key and checks CURLOPT_USE_SSL

How this analysis ran 5 claims · 0 citations verified

Checked against curl master on 2026-03-22 (9820e5dface5). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding

grounded

no model · 1 references checked out, 0 did not

2 · Claims

NVIDIA-Nemotron-3-Nano-30B-A3B

5 claims · 1328 tokens · $0.0002

3 · Evidence

0 code snippets

real curl source at 9820e5dface5

4 · Judgment

Nemotron-3-Ultra-550b-a55b

4358 tokens · 3.8s · $0.0065

5 · Receipts

0 of 0 citations verified

every citation must point at code the judge was shown

Review a draft reply to the reporter

Edit and verify before sending.

Thank you for the report. To assess this, we need the curl source code for the connection reuse logic at the reported revision. Please provide or point to the relevant files (lib/conncache.c, lib/urlapi.c, and the SMTP/POP3/IMAP protocol handlers) so we can verify whether CURLOPT_USE_SSL is properly included in connection matching for cleartext-upgrade mail protocols.

Inspect all claims and source code 5 claims · 0 code excerpts

Report claims

C1flaw not verifiable

connection reuse for cleartext-upgrade mail protocols does not include the later transfer's CURLOPT_USE_SSL

Read the reasoning

No curl source code was provided to examine the connection reuse logic or how CURLOPT_USE_SSL is handled in connection matching. The deterministic checks only confirm the symbol exists, not its usage in connection reuse.

C2location not verifiable

for cleartext-upgrade mail protocols

Read the reasoning

No curl source code was provided to verify which protocols are affected or to examine protocol-specific connection reuse handling for SMTP, POP3, and IMAP.

C3trigger not verifiable

a later transfer that explicitly requires STARTTLS can incorrectly reuse that plaintext connection

Read the reasoning

Without the connection reuse code, I cannot verify whether a later transfer requiring STARTTLS can incorrectly reuse a plaintext connection.

C4impact not verifiable

later TLS-required mail transfer can be sent over a previously established plaintext connection

Read the reasoning

Impact claim depends on the flaw being real; without code to verify the flaw, the impact cannot be assessed.

C5reproduction not verifiable

Start the server: python3 ./server.py --port 2525; then use curl with --ssl-reqd on imap://127.0.0.1:2525/Box/;MAILINDEX=1 and later reuse the connection with -X NOOP --next

Read the reasoning

Reproduction steps reference a server.py and curl commands, but without the curl source code I cannot verify whether the described steps would trigger the claimed behavior.

Read the original report

Full report on HackerOne ↗

Libcurl connection reuse for cleartext-upgrade mail protocols does not include the later transfer's CURLOPT_USE_SSL. If a plaintext connection to one of these protocols is already open and reusable, a later transfer that explicitly requires STARTTLS can incorrectly reuse that plaintext connection. This affects smtp://, pop3://, and imap:// ## Reproduction Start the server: ```bash python3 ./server.py --port 2525 ``` Control: ```bash curl -sv \ -u alice:pw \ --url 'imap://127.0.0.1:2525/Box/;MAILINDEX=1' \ --ssl-reqd ``` Reuse: ```bash curl -sv \ -u alice:pw \ --url 'imap://127.0.0.1:2525/' \ -X NOOP \ --next \ -sv \ -u alice:pw \ --url 'imap://127.0.0.1:2525/Box/;MAILINDEX=1' \ --ssl-reqd ``` ## Impact A later TLS-required mail transfer can be sent over a previously established plaintext connection, contrary to expectation.

Source code

No source code was retrieved for this analysis. The evidence may be incomplete.