CVE-2026-92391
curl_mime_free stack overflow by recursion
Project curl Security Advisory, October 14 2026 Permalink
VULNERABILITY
A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within curl_mime_free leads to unbounded stack frame allocation during structure traversal, ultimately crashing
the host process.
INFO
Normal mime setups typically contain a few parts up to extreme cases of hundreds. This flaw needs thousands to trigger, the exact amount depending on your system and configuration.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-92391 to this issue.
CWE-674: Uncontrolled Recursion
Severity: Low
AFFECTED VERSIONS
- Affected versions: curl 7.56.0 to and including 8.22.0
- Not affected versions: curl < 7.56.0 and >= 8.23.0
- Not affected versions: curl >= 8.20.2 in the 8.20.X branch
- Not affected versions: curl >= 8.16.2 in the 8.16.X branch
- Not affected versions: curl >= 8.14.3 in the 8.14.X branch
- Introduced-in: https://github.com/curl/curl/commit/ce0881edee3c78609eae49
libcurl is used by many applications, but not always advertised as such!
This flaw does not affect the curl command line tool.
SOLUTION
RECOMMENDATIONS
A - Upgrade curl to version 8.23.0
B - Apply the patch to your local version
C - Avoid the MIME API
TIMELINE
This issue was reported to the curl project on September 12, 2026.
curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.
CREDITS
- Reported-by: Joshua Rogers (Aisle Research)
- Patched-by: Daniel Stenberg
Thanks a lot!