CVE-2026-4873
connection reuse ignores TLS requirement
Description
A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.
INFO
Published Date :
May 13, 2026, 8:27 a.m.
Last Modified :
May 13, 2026, 9:05 a.m.
Remotely Exploit :
No
Source :
curl
Solution
- Update the software to enforce TLS for all connections.
- Configure connection pooling to prevent unencrypted connection reuse.
- Disable plaintext protocols like IMAP, SMTP, and POP3 if not needed.
- Review TLS configuration for all network services.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-4873 vulnerability anywhere in the article.