DEBIAN-CVE-2026-92388 - curl/curl
When an FTP wildcard LIST fails, the transfer kept the list parser installed as the write callback instead of restoring the user write function. Backport of upstream ba8f8a7f to 8.14.1, adapted: struct ftp_wc lives in lib/ftp.h here and lib/cw-out.c has a single CW_OUT_BODY case.
Evidence
- regression test tests/unit/unit5035 RED on revert, GREEN on fix (adversarial re-review PASS)
- targeted checks clean (bash -n, shellcheck, git diff --check)
History
- 2026-10-28: Fixed in fork - merged to fork master baf4548