curl 8.23.0 fixes high-severity HTTP/2 use-after-free
curl 8.23.0 fixes high-severity HTTP/2 use-after-free CVE-2026-92392 that can crash clients or, rarely, run code.
curl 8.23.0, released October 14, 2026, fixes CVE-2026-92392, a high-severity HTTP/2 upload use-after-free in curl and libcurl versions 8.12.0 through 8.22.0. After a server pauses an upload of roughly 135KB, returns part of a response, and resets the stream, libcurl can keep a pointer to a freed easy handle; later multi-handle cleanup may write server-controlled data into that memory and call a modified function pointer, enabling remote code execution on the client. Exploitation requires a certificate the client trusts plus architecture-specific payloads, allocator behavior, and precise build and memory-layout knowledge. curl says a crash is more likely and in-the-wild success is slim, while The Hacker News reports that a public proof of concept showed client-side code execution; sources agree no attacks are reported. The issue was found by Luna Tong of Anthropic, with Claude, via Anthropic's OSS Scanner, and Daniel Stenberg published the advisories. The release also fixes 23 low-severity CVEs.
- CVE-2026-92392 is a high-severity HTTP/2 upload use-after-free in curl and libcurl 8.12.0 through 8.22.0, fixed in curl 8.23.0 released October 14, 2026.
- A malicious server with a certificate the client trusts can pause an upload of about 135KB, return part of a response, and reset the stream, leaving a dangling pointer to a freed easy handle.
- Later multi-handle cleanup may write server-controlled data into that memory and invoke a modified function pointer, enabling client-side remote code execution.
- curl says many conditions must align, including architecture-specific payloads, allocator behavior, and exact build and memory-layout knowledge; a crash is the likelier outcome and in-the-wild success is considered slim.
- A public proof of concept demonstrated client-side code execution; no attacks using the flaw are reported.
- The bug was reported by Luna Tong of Anthropic, with Claude, using Anthropic's OSS Scanner; Daniel Stenberg published the curl 8.23.0 security advisories.
- The same release also fixes 23 low-severity CVEs.
Coverage timelineoldest first · each row is one article
- · 2d agoA UAF turned RCE
Lobsters · security· 68
curl 8.23.0 fixes CVE-2026-92392, a high-severity HTTP/2 use-after-free that can lead to RCE.
- · 2d agocurl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
The Hacker News· 66
curl 8.23.0 fixes high-severity HTTP/2 use-after-free CVE-2026-92392 after a PoC showed client code execution.
- · 2d ago[SECURITY ADVISORIES] curl 8.23.0
oss-security· 68
curl 8.23.0 fixes high-severity HTTP/2 upload use-after-free CVE-2026-92392.
Vulnerabilities in this storyAll →
- CVE-2026-923928.1<1%HTTP/2 upload use-after-free in curlpublished · curl / libcurl PoC
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-92392 | HTTP/2 upload use-after-free in curl CVE-2026-92392 is a use-after-free (CWE-416) in curl during an HTTP upload. If the server sends an HTTP/2 RST_STREAM with reason HTTP_1_1_REQUIRED or REFUSED_STREAM, curl mishandles the stream and frees a struct Curl_easy that is still used. A network attacker who controls or can influence the server the client uploads to can crash the client and, according to public reporting of a proof of concept, reach client-side code execution; CVSS 3.1 is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Anyone running a vulnerable curl or libcurl that performs HTTP/2 uploads is affected, including applications that bundle the library. Exploitation is not listed in CISA KEV and EPSS is about 0.2%, but one public proof-of-concept reference exists, so exploitation status is proof-of-concept public rather than confirmed in the wild. |