curl vulnerability in HTTP/2 uploads fixed in 8.23.0
The curl vulnerability tracked as CVE-2026-92392 allows a malicious server receiving an HTTP/2 upload to corrupt memory on the client that sent it. curl fixed the high-severity flaw on October 14 in version 8.23.0 after the reporter demonstrated code execution, meaning the server could make the uploading computer run chosen instructions. The project nevertheless expects most real exploitation attempts to crash the affected program because reliable code execution requires detailed knowledge of the target.
The vulnerability affects curl and libcurl versions 8.12.0 through 8.22.0. curl is a command-line file transfer tool, while libcurl is the underlying software library used by many other applications. The flaw is a use-after-free, which happens when software continues using an area of memory after it has been released for another purpose. Both the command-line tool and applications built with the affected library can be exposed.
Several conditions must be met. A client must upload a file of roughly 135KB over HTTP/2, the protocol used to carry multiple web transfers over one connection, to a server controlled by the attacker. The server's certificate must pass the client's checks, and libcurl must have been built with HTTP/2 support. For addresses beginning with https://, libcurl negotiates HTTP/2 by default when the server offers it. The vulnerable code has been present in every curl release since 8.12.0, issued in February 2025. No source reports attacks exploiting the flaw.
The failure begins when the hostile server pauses the upload by reducing the HTTP/2 transfer window to zero. It returns part of a response, resets the stream and leaves the connection open. curl interprets that reset as a reason to retry the transfer. During cleanup, the affected versions first tell the HTTP/2 layer that the transfer has finished and then flush the remaining upload data into the same connection.
Because the transfer is no longer registered at that point, the leftover data can be interpreted as a fresh request. The proof of concept places a particular pattern of lines in the uploaded file so those bytes resemble request lines. libcurl then creates another stream and stores a pointer to the transfer's easy handle, an internal object used to track an individual operation. The retry finishes over a new HTTP/1.1 connection, after which the application frees that handle. The original connection still retains the pointer and can use it when the server sends another frame, including while the program is exiting.
In the demonstrated exploit, server-controlled data occupies the memory previously used by the freed handle. An outgoing request then exposes local memory addresses needed to bypass address space layout randomization (ASLR), a protection that changes where program data is placed in memory. The exploit replaces a function pointer with server-supplied bytes, after which curl calls that pointer. According to curl's advisory, success requires the exact curl version, processor architecture, libc allocator and heap layout. It also depends on precise timing across two parallel transfers and fitting the payload into about 23 bytes. curl therefore assessed successful takeover as unlikely and said a crash is the more probable result.
Users should install curl and libcurl 8.23.0. The advisory also identifies fixed releases for three older branches: 8.14.3 for 8.14.x, 8.16.2 for 8.16.x and 8.20.2 for 8.20.x. Debian 13, also known as trixie, provides 8.14.1-2+deb13u7 through DSA-6558-1, according to Debian's tracker. Debian 12, or bookworm, does not contain the vulnerable code. The project also said updated Rock-solid curl releases, its long-term-support line for customers with support contracts, would ship alongside 8.23.0. The release addresses 24 CVEs in total; the other 23 are rated Low.
Where an immediate update is not possible, curl advises avoiding HTTP/2. Command-line users can request HTTP/1.1 with the --http1.1 option. Applications using libcurl can set CURLOPT_HTTP_VERSION to CURL_HTTP_VERSION_1_1. curl cautions that this is a request rather than an absolute guarantee because the application might reuse an existing connection that uses another protocol version. A libcurl build compiled without HTTP/2 support cannot enter the affected upload path.
The repair is a six-line reordering in lib/multi.c. libcurl now flushes the remaining upload data before the HTTP/2 layer releases its references to the transfer handle. The report arrived through HackerOne on September 15 and curl confirmed it within hours. On October 7, the project announced that a High-severity correction was coming and shortened its release cycle from eight weeks to six. This was curl's first High-rated vulnerability since the SOCKS5 heap overflow in October 2023. curl uses four severity categories and does not publish a Common Vulnerability Scoring System (CVSS) score. The National Vulnerability Database had not completed its analysis as of October 14.
curl attributed the discovery to Anthropic's OSS Scanner, an opt-in service opened on October 8 that uses AI models to examine enrolled open-source projects. Anthropic says the service emails findings without human review and includes a reproducer and, when available, a possible patch. This report was submitted three weeks before the service's public launch. The public HackerOne entry, including a malicious server script and a Docker container described as reproducing code execution, appeared with the curl advisory on October 14.
The finding also follows curl's concerns about low-quality AI-generated reports. In July 2025, a curl maintainer wrote that about one fifth of that year's security submissions had been classified as AI slop and only about one in twenty had proved valid. The project has separately been reducing internal pointers to transfer handles in favor of identifiers that are looked up when required, but says this does not guarantee that another use-after-free will not occur. It considers this flaw the kind of memory-management mistake that a memory-safe language would probably prevent, although it has no plan to rewrite curl in one.
Website owners should ask their hosting provider or application maintainer whether affected libcurl packages are installed, since applications may rely on the library without exposing it directly. For organizations reviewing the systems around affected applications, AEU-I offers security-first IT, infrastructure and consulting.