"The most likely outcome of an attempted attack is rather just a crash," Daniel Stenberg wrote — a caution that understates how a subtle HTTP/2 upload sequence can let a hostile server corrupt memory on machines running the curl client and libcurl library.
CVE-2026-92392: affected releases and patch timing
The curl project fixed the flaw on October 14 in curl 8.23.0. The bug, tracked as CVE-2026-92392, affects both the command-line curl tool and libcurl in releases 8.12.0 through 8.22.0. curl rated the issue High on its four-level severity scale — its first High-severity finding since the SOCKS5 heap overflow of October 2023 — and shortened its release cycle by two weeks to ship the remediation.
curl's machine-readable advisory and release notes list the fixed versions across maintained branches and downstream packaging. Affected users should upgrade to one of the published fixes:
- Upgrade mainline to curl and libcurl 8.23.0 (fixes 8.12.0–8.22.0)
- 8.14.x branch: 8.14.3
- 8.16.x branch: 8.16.2
- 8.20.x branch: 8.20.2
- Debian 13 (trixie): packages through DSA-6558-1 are addressed as 8.14.1-2+deb13u7; Debian 12 (bookworm) does not carry the vulnerable code
The release bundles fixes for 24 CVEs in all; the other 23 were rated Low.
How a hostile HTTP/2 server can corrupt a client
The vulnerability arises during an upload over HTTP/2. An attacker-controlled server can stall an upload by setting the HTTP/2 flow-control window to zero, return part of the response, then reset the stream while keeping the connection open. libcurl treats the reset as a reason to retry the transfer.
During cleanup, curl previously told its HTTP/2 layer the transfer was finished and then flushed the remaining unsent upload data into the same connection. With no active transfer registered, those leftover bytes can be misinterpreted as a new request; the reporter's uploaded data intentionally contains a line pattern that looks like HTTP request lines. When that happens, libcurl opens a new stream that stores a pointer back to the original transfer's easy handle.
The retry then completes on a new HTTP/1.1 connection and the application frees the easy handle. The original connection still holds the stale pointer; if the server later sends a frame on that stream, the HTTP/2 code can use the dangling pointer. In the reporter's exploit, server-sent bytes landed in the freed handle's memory, leaked local addresses (to defeat ASLR), and overwrote a function pointer which libcurl subsequently called.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogAttack difficulty, impact, and curl's risk assessment
curl's advisory stresses the practical difficulty of turning the memory corruption into reliable remote code execution. The exploit published with the report and Docker reproducer requires precise knowledge of the target's exact curl version, CPU architecture, libc allocator and heap layout; it needs two parallel transfers timed correctly; and the payload must fit into roughly 23 bytes. The reporter's demonstration reached code execution, but curl expects attempts in the wild are more likely to cause crashes than reliable takeovers — a reason the project rated this flaw High rather than Critical.
curl uses an internal four-level severity scale and publishes no CVSS score. The National Vulnerability Database had not analyzed the record as of October 14.
What to install and short-term mitigations
curl's direct guidance is to upgrade to 8.23.0 or apply the shipped fix commit to a local build. If updating immediately is not possible, curl recommends avoiding HTTP/2 for uploads: for the command-line tool, use the --http1.1 option; for applications using libcurl, set CURLOPT_HTTP_VERSION to CURL_HTTP_VERSION_1_1. curl's documentation notes that this is a request and existing connections of other versions may be reused, so builders should verify how their deployments handle connection reuse.
HTTP/2 support in libcurl is a build-time option; a build compiled without HTTP/2 cannot negotiate that protocol and therefore cannot reach this upload path.
Anthropic's OSS Scanner, the reporter, and curl's response
curl credits the find to "Luna with Claude, Anthropic." Daniel Stenberg named the reporter as Luna Tong of Anthropic and said the report arrived through HackerOne on September 15; curl confirmed the issue within hours. The HackerOne write-up — published with the advisory on October 14 — included a malicious server script and a Docker container described as reproducing the code execution.
Anthropic opened its OSS Scanner on October 8 as an opt-in service that scans enrolled projects with its models and emails results without human review; each report includes a reproducer and, where available, a candidate patch. Stenberg said the finding came through the company's new OSS Scanner and presumes its AI models were involved. curl's maintainer has previously noted a high volume of low-quality automated submissions, saying in July 2025 that about a fifth of that year's security submissions were "AI slop" and only about one in twenty proved genuine.
The actual code fix is small: a six-line reorder in lib/multi.c by Stefan Eissing. The HTTP/2 layer now releases references to the easy handle only after leftover upload data has been flushed, eliminating the window that allowed the dangling-pointer use-after-free.
Original reporting: https://thehackernews.com/2026/10/curl-patches-http2-upload-flaw-after.html
