CVE-2026-92392

During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRE…

During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.

Vendor: Unknown
Product: Unknown
CVSS: No score recorded
CWE: Not recorded
Published: 2026-10-14
NVD modified: 2026-10-14
NVD status: Received

Not in the CISA KEV catalogue at the last update.

ThreatWire coverage

CVE-2026-92392 record: curl and libcurl HTTP/2 upload use-after-free
curl HTTP/2 upload flaw CVE-2026-92392 PoC reached code execution

References

curl.se
curl.se
hackerone.com

Data last updated 15 Oct 2026. Sources: NVD API 2.0. Links: NVD, CISA KEV. Metadata only. ThreatWire does not host exploit code.