libcurl (Product): news timeline & CVEs

USN-8932-1: curl vulnerabilities

Ubuntu patched curl flaws that could leak AWS SigV4 state or proxy credentials.

Ubuntu published USN-8932-1 for curl flaws discovered by Stanislav Fort that could expose sensitive authentication data. CVE-2026-86409 concerns AWS SigV4 state not being cleared when CURLOPT_AWS_SIGV4 is set to NULL, and it affects only Ubuntu 22.04 LTS and 24.04 LTS. CVE-2026-86414 lets an HTTP proxy elicit credentials by answering a CONNECT request with an unexpected authentication challenge. The notice also describes improper handling of HSTS entries when an includeSubDomains parent is imported.

Ubuntu Security NoticesOct 14, 19:26 UTC · 2d agoAdvisory 2 sources CVE-2026-86409 CVE-2026-864142

curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution

curl 8.23.0 fixes high-severity HTTP/2 use-after-free CVE-2026-92392 after a PoC showed client code execution.

curl 8.23.0, released October 14, fixes CVE-2026-92392, a high-severity use-after-free in curl and libcurl 8.12.0 through 8.22.0. A malicious server that receives an HTTP/2 upload of roughly 135KB, and whose certificate the client trusts, can corrupt the uploading client's memory; a public proof of concept showed code execution, but curl says success requires exact build and memory-layout knowledge and a crash is more likely. No attacks using the flaw are reported. The release also fixes 23 low-severity CVEs. The reporter is credited as Luna Tong of Anthropic, with Claude, via Anthropic's OSS Scanner.

The Hacker Newsupdated Oct 14, 14:41 UTC · 2d agofirst Oct 14, 12:13 UTC · 2d agoVulnerability 3 sources CVE-2026-923923· 2 reads

A UAF turned RCE

curl 8.23.0 fixes CVE-2026-92392, a high-severity HTTP/2 use-after-free that can lead to RCE.

curl 8.23.0 fixes CVE-2026-92392, rated HIGH, an HTTP/2 upload use-after-free in libcurl. After a server pauses an upload, returns part of a response, and resets the stream, curl can retain a pointer to a freed easy handle; later multi-handle cleanup may write server-controlled data into that memory and invoke a modified function pointer, enabling remote code execution. The project says many conditions must align, including a valid certificate, an upload near 135KB, architecture-specific payloads, and allocator behavior, so a crash is the likely outcome and in-the-wild success is considered slim. It was reported by Luna Tong at Anthropic using the OSS Scanner.

Lobsters · securityupdated Oct 14, 14:41 UTC · 2d agofirst Oct 14, 09:44 UTC · 2d agoVulnerability 3 sources CVE-2026-923924· 2 reads

libcurl

Timeline3 articles

Related CVEsby mentions

Appears with

USN-8932-1: curl vulnerabilities

curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution

A UAF turned RCE