curl 8.23.0 Fixes High-Severity HTTP/2 Upload Use-After-Free (CVE-2026-92392)

curl 8.23.0, released on 14 October 2026, addresses 24 security vulnerabilities, including a high-severity use-after-free in the HTTP/2 upload path tracked as CVE-2026-92392. The curl project rates it High on its four-level scale, the first High-severity issue since the SOCKS5 heap buffer overflow fixed in late 2023. The release also drops support for the SMB protocol.

curl 8.23.0 at a Glance

Vulnerability Details

During an HTTP/2 upload, curl mishandles an RST_STREAM frame from the server when the reason is HTTP_1_1_REQUIRED or REFUSED_STREAM. This leads to a use-after-free of a struct Curl_easy object. The project describes the issue as a classic C-language mistake involving a dangling pointer to freed memory.

The advisory notes that the flaw has been demonstrated to convert into remote code execution under a set of specific conditions. Those include knowing the exact curl version and structure layout to derive attack offsets, maintaining correctly calibrated parallel transfers and timing, obtaining appropriate libc leak and symbol offsets, and fitting the payload into a short-command constraint of roughly 23 bytes. In practice, the most likely outcome of an attempted attack is a crash rather than reliable code execution.

Exploitation also requires the client to upload roughly 135 KB of data over HTTP/2 to a server controlled by the attacker, with the server certificate passing the client's validation checks. libcurl negotiates HTTP/2 by default for HTTPS URLs when the server supports it and the library was built with HTTP/2 support.

Affected versions are curl and libcurl 8.12.0 through 8.22.0. Versions before 8.12.0 and 8.23.0 and later are not affected. The flaw impacts both the command-line tool and the library.

Discovery and Timeline

The issue was reported to the curl project on 15 September 2026 via HackerOne. The security team confirmed it within hours. Credits list the reporter as "Luna with Claude, Anthropic." Project lead Daniel Stenberg has identified the finder as Luna Tong at Anthropic, who used the company's OSS Scanner, and has noted that AI models were likely involved. The project accelerated its release cycle by roughly two weeks to ship the fix in 8.23.0 rather than waiting for the originally planned schedule. Full details were published in coordination with the release on 14 October.

The fix itself is a relatively small change that reorders cleanup so the HTTP/2 layer drops its references to the handle only after leftover upload data has been flushed. Stefan Eissing is credited with the patch.

Broader Context of the Release

curl 8.23.0 includes fixes for 23 additional low-severity issues alongside the high-severity flaw. Many of those involve credential or connection-reuse problems, cookie and HSTS handling edge cases, and various protocol-specific issues. The release also removes support for SMB and SMBS. Stenberg has previously noted that the NTLM implementation required for SMB support was error-prone and that the code only handled SMBv1 in any case.

No public reports of in-the-wild exploitation of CVE-2026-92392 have appeared as of the release date. Because reliable code execution requires precise knowledge of the target's build, memory layout, and timing, opportunistic attacks are more likely to produce crashes than full control. That said, the flaw is still a high-severity client-side issue in widely deployed software, and any process that uploads data over HTTP/2 to potentially untrusted or attacker-controlled servers is exposed.

Recommendations

Upgrade curl and libcurl to 8.23.0, or apply the relevant patch and rebuild. Fixed versions are also available on selected older branches (for example, 8.14.3, 8.16.2, and 8.20.2). Distributions have begun shipping updates; Debian 13 (trixie) received a security update via DSA-6558-1, while Debian 12 does not contain the vulnerable code.

As a temporary mitigation, avoid HTTP/2. The curl command-line tool can be forced to HTTP/1.1 with the --http1.1 option. Applications using libcurl can set CURLOPT_HTTP_VERSION to CURL_HTTP_VERSION_1_1. Note that this is a request rather than a hard guarantee if an existing connection on another protocol version is reused.

Organizations that rely on curl or libcurl for automated uploads, API clients, or embedded transfers should inventory HTTP/2 usage and prioritize the update, particularly in environments where clients upload data to servers outside their control. The combination of a high-severity memory-safety issue and the availability of a public proof-of-concept path makes prompt remediation the practical course even though real-world exploitation conditions are narrow.

Sources

• curl: CVE-2026-92392 advisory
• heise online: New curl version removes SMB support and fixes 24 security vulnerabilities
• The Hacker News: curl patches HTTP/2 upload flaw after AI-assisted find
• Unsafe.sh: discussion of the curl fix
• Freenode: curl 8.23.0 fixes 24 vulnerabilities, one high severity

Track exploited and high-severity flaws as they land with the Threat Landscape Platform — structured STIX intelligence, IoC feeds, and darknet monitoring. Start with a free account, no credit card required, or go Professional from $49/month.