CVE-2026-92392
HTTP/2 upload Use-After-Free
Project curl Security Advisory, October 14 2026 Permalink
VULNERABILITY
During an upload, curl mishandles HTTP/2 RST_STREAM received from the server (with reason HTTP_1_1_REQUIRED or REFUSED_STREAM) leading to a use after free of a struct Curl_easy object.
INFO
This Use-After-Free flaw has been proven to be possible to convert into a Remote Code Execution if a set of specific criteria are met by the malicious server:
- the exact curl version object and structure layout used for the transfer is known and used to derive attack offsets;
- exact architecture details of the running curl needs to be known
- a known and compatible libc allocator build and heap layout
- nghttp2 and OpenSSL/TLS 1.3 behavior, including allocation effects around session tickets
- a pinned CA bundle and other input-dependent allocation geometry
- two parallel transfers and their scheduling/timing need to remain
- correctly calibrated libc leak and symbol offsets; and
- the exploit's current short-command constraint (approximately 23 bytes).
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-92392 to this issue.
CWE-416: Use After Free
Severity: High
This bug is considered a C mistake (likely to have been avoided had we not been using C).
AFFECTED VERSIONS
- Affected versions: curl 8.12.0 to and including 8.22.0
- Not affected versions: curl < 8.12.0 and >= 8.23.0
- Not affected versions: curl >= 8.20.2 in the 8.20.X branch
- Not affected versions: curl >= 8.16.2 in the 8.16.X branch
- Not affected versions: curl >= 8.14.3 in the 8.14.X branch
- Introduced-in: https://github.com/curl/curl/commit/cd9107e0128191b7b5396b
libcurl is used by many applications, but not always advertised as such!
This flaw also affects the curl command line tool.
SOLUTION
RECOMMENDATIONS
A - Upgrade curl to version 8.23.0
B - Apply the patch to your local version
C - Do not use HTTP/2
TIMELINE
This issue was reported to the curl project on September 15, 2026.
curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.
CREDITS
- Reported-by: Luna with Claude, Anthropic
- Patched-by: Stefan Eissing
Thanks a lot!