CVE-2026-92390
-J no-clobber guarantee bypassed with 103 early hints
Project curl Security Advisory, October 14 2026 Permalink
VULNERABILITY
When invoked with --remote-header-name (-J), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before
Content-Disposition under --etag-save. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the Content-Disposition header despite the presence of the -J non-overwrite constraint.
INFO
This problem is similar, but not identical, to the previous vulnerability CVE-2020-8177
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-92390 to this issue.
CWE-73: External Control of File Name or Path
Severity: Low
This bug is not considered a C mistake (likely to have been avoided had we not been using C).
AFFECTED VERSIONS
- Affected versions: curl 7.20.0 to and including 8.22.0
- Not affected versions: curl < 7.20.0 and >= 8.23.0
- Not affected versions: curl >= 8.20.2 in the 8.20.X branch
- Not affected versions: curl >= 8.16.2 in the 8.16.X branch
- Not affected versions: curl >= 8.14.3 in the 8.14.X branch
- Introduced-in: https://github.com/curl/curl/commit/80675818e0417b
curl is used by many applications, but not always advertised as such!
This flaw only affects the curl command line tool, not libcurl.
SOLUTION
RECOMMENDATIONS
A - Upgrade curl to version 8.23.0
B - Apply the patch to your local version
C - Avoid using the -J option
TIMELINE
This issue was reported to the curl project on September 12, 2026.
curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.
CREDITS
- Reported-by: Joshua Rogers (Aisle Research)
- Patched-by: Joshua Rogers (Aisle Research)
Thanks a lot!