CVE-2026-13608

libcurl's SASL negotiation used for LDAP authentication can misinterpret an incomplete handshake sequence as a completed, successful cryptographic verification, leaving the peer improperly validated (CWE-923, improper restriction of the communication channel to intended endpoints). An attacker in a Man-in-the-Middle position between the curl client and the LDAP server can inject a premature or shortcut SASL response that ends negotiation early. This bypasses complete peer validation, allowing the attacker to impersonate the LDAP endpoint and intercept or tamper with the authentication exchange, which the CVSS vector reflects as high confidentiality and integrity impact with no availability impact. Any application, tool, or device embedding a libcurl build that connects to LDAP servers with SASL authentication is potentially affected. Exploitation status is currently quiet: there is no known public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at roughly 0.5% (42nd percentile).

What to do: Update libcurl (and packages linking it, including the curl CLI) to the fixed release named in the upstream curl security advisory once published, as no fixed version is specified in the available data. Until patched, avoid ldap:// URLs with SASL authentication, prefer ldaps:// (TLS-protected) LDAP endpoints, or build curl with LDAP support disabled, and check whether any scheduled jobs, integrations, or appliances in your environment use curl against LDAP servers. Note that successful exploitation requires an attacker-controlled network position between client and LDAP server, so segmenting or egress-filtering LDAP traffic reduces risk.