[SECURITY ADVISORIES] curl 8.23.0
curl 8.23.0 fixes high-severity HTTP/2 upload use-after-free CVE-2026-92392.
Daniel Stenberg published the security advisories accompanying curl 8.23.0. The project rates CVE-2026-92392, a use-after-free affecting HTTP/2 uploads, as high severity. The available excerpt does not state that the vulnerability is being exploited.
- Daniel Stenberg announced security fixes in curl 8.23.0
- CVE-2026-92392 is a high-severity HTTP/2 upload use-after-free
- The excerpt does not report observed exploitation
Vulnerabilities mentionedAll →
- CVE-2026-923928.1<1%HTTP/2 upload use-after-free in curlpublished · curl / libcurl PoC
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-92392 | HTTP/2 upload use-after-free in curl CVE-2026-92392 is a use-after-free (CWE-416) in curl during an HTTP upload. If the server sends an HTTP/2 RST_STREAM with reason HTTP_1_1_REQUIRED or REFUSED_STREAM, curl mishandles the stream and frees a struct Curl_easy that is still used. A network attacker who controls or can influence the server the client uploads to can crash the client and, according to public reporting of a proof of concept, reach client-side code execution; CVSS 3.1 is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Anyone running a vulnerable curl or libcurl that performs HTTP/2 uploads is affected, including applications that bundle the library. Exploitation is not listed in CISA KEV and EPSS is about 0.2%, but one public proof-of-concept reference exists, so exploitation status is proof-of-concept public rather than confirmed in the wild. |
Posted by Daniel Stenberg on Oct 14 Hello, https://curl.se/docs/security.html One vulnerability is considered severity HIGH: CVE-2026-92392: HTTP/2 upload Use-After-Free The...
This source does not provide full text. Read it at seclists.org.