CVE-2026-92392
curl and libcurl HTTP/2 upload use-after-free
curl and libcurl 8.12.0 to 8.22.0 can free memory and keep using it when a malicious HTTP/2 server resets an upload. The curl project rates it High. A reporter PoC reached code execution under strict conditions. Fixed in curl 8.23.0 on 14 October 2026, plus branch fixes. Not in CISA KEV.
- CVSS
- Unknown
- Vector
- Not recorded
- Class
- RCE
- Status
- PoC Available
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- curl
- Products
- curl, libcurl
- Affected
- curl and libcurl 8.12.0 up to and including 8.22.0, both the command line tool and the library. Branch releases 8.14.3, 8.16.2 and 8.20.2 and later on those branches are not affected.
- Fixed
- curl 8.23.0, released 14 October 2026. Branch fixes in 8.14.3, 8.16.2 and 8.20.2. Debian DSA-6558-1 for trixie.
- CWE
- CWE-416
- Published
- 14 Oct 2026
- Updated
- 14 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-92392 is a use-after-free (CWE-416) in curl and libcurl. It happens during an upload over HTTP/2 when the server resets the stream in a specific way. Both the curl tool and the library are affected.
The curl project rates it High on its own scale. NVD has no CVSS score yet. SUSE gives its own CVSS 3.1 score of 9.8 and rates it critical. Ubuntu gives it High priority.
Affected versions are 8.12.0 up to and including 8.22.0. The fix is in curl 8.23.0, released on 14 October 2026. Branch fixes exist in 8.14.3, 8.16.2 and 8.20.2. Debian fixed trixie in DSA-6558-1.
The curl project says code execution needs many exact conditions. The attacker must control the server, with a valid certificate. The attacker must also know the exact curl build, architecture, libc and heap layout. The payload is tiny, about 23 bytes. The project expects crashes to be more likely than takeovers in the wild.
The flaw was reported on 15 September 2026. Credit goes to Luna Tong with Claude at Anthropic. Stefan Eissing wrote the fix.
The CVE is not in the CISA KEV catalog. No exploitation in the wild is reported. The reporter's HackerOne report is public. It carries a proof of concept and a video that the curl project says reached code execution under strict lab conditions. ThreatWire did not run it. The PoC link field points to the report; the URL is not repeated here.