curl HTTP/2 upload flaw CVE-2026-92392 PoC reached code execution

What happened

The curl project released curl 8.23.0 on 14 October 2026. It fixes CVE-2026-92392, a use-after-free in HTTP/2 uploads. Maintainer Daniel Stenberg calls it one of the worst curl flaws in a long time.

A malicious server can reset an upload stream in a certain way. curl then keeps a pointer to memory it already freed. Data from the server can land in that memory.

Luna Tong with Claude at Anthropic reported the flaw on 15 September 2026. Stenberg says Anthropic found it with a new open source scanner. Stefan Eissing wrote the fix. The project cut two weeks from its release cycle to ship it.

Who is affected

curl and libcurl 8.12.0 up to and including 8.22.0 are affected. That covers the command line tool and any application built on libcurl. Many apps embed libcurl without saying so.

The flaw only triggers on uploads over HTTP/2. curl uses HTTP/2 by default for HTTPS when the server supports it. The server must be malicious or compromised, and its certificate must be valid.

What is confirmed

The curl project rates the flaw High on its four-level scale. NVD has not added a CVSS score. SUSE scores it CVSS 3.1 9.8 and rates it critical. Ubuntu gives it High priority.

The fixed release is 8.23.0. Branch fixes exist in 8.14.3, 8.16.2 and 8.20.2. Debian fixed trixie in DSA-6558-1, and unstable has 8.23.0.

The curl advisory says the bug has been proven convertible into remote code execution. It lists strict conditions. The attacker must know the exact curl build, CPU architecture, libc allocator and heap layout. Two parallel transfers must be timed right. The payload has room for only about 23 bytes.

The reporter's HackerOne report is now public. It includes a proof of concept and a video demonstration. They claim code execution on the client. ThreatWire did not run them.

The CVE is not in the CISA KEV catalog. The Hacker News covered the fix and the PoC.

What is not confirmed

There is no report of exploitation in the wild. The curl project deems the conditions extremely hard to meet outside a lab. It expects real attacks to cause crashes more often than takeovers.

ThreatWire found only one established outlet covering the flaw so far. A third-party GitHub repository also claims a checker and PoC for this CVE. ThreatWire did not review it and does not link it. Fix status for other distributions is still changing.

What to do

Update curl and libcurl to 8.23.0, or to a fixed branch release. Install your distribution's patched package where one exists. Rebuild or update applications that bundle their own libcurl.

If you cannot update yet, the curl project suggests not using HTTP/2. Prioritize systems that upload data to servers outside your control. CI jobs and scripts are common examples.

Sources: the curl advisory and changelog, the HackerOne report, Daniel Stenberg's post, NVD, CVE.org, Debian, Ubuntu, SUSE and The Hacker News. Links are in the references list.