curl 8.23.0 fixes HTTP/2 flaw after PoC shows client

Feeds.4Sysops •IT News • October 14, 2026

curl has released version 8.23.0 to fix a flaw that a public proof of concept shows can enable code execution on a client uploading a file to a malicious HTTP/2 server. Anthropic’s OSS Scanner had flagged a serious curl flaw ; the newly disclosed CVE-2026-92392 affects curl and libcurl 8.12.0 through 8.22.0. Successful exploitation requires precise knowledge of the target’s build and memory layout, and a crash is considered more likely. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

curl 8.23.0 Fixes High-Severity HTTP/2 Upload Flaw On October 14, 2026, curl released version 8.23.0 to address a critical use-after-free vulnerability (CVE-2026-92392) affecting versions 8.12.0 to 8.22.0. This flaw allows a malicious HTTP/2 server to execute code on the client's machine during file uploads, requiring specific conditions to be met. The vulnerability has been rated as high severity by the curl project, marking its first such rating since October 2023. The flaw, which has been present since February 2025, affects both curl and libcurl, used widely across various applications. Users are advised to upgrade to the latest version or disable HTTP/2 support until they can patch. The release also removes SMB support due to security concerns. A proof-of-concept exploit has been made public, but there are currently no reports of in the wild. 8 sources 65

Extracted Entities

curl 8.23.0 fixes HTTP/2 flaw after PoC shows client

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Tools (2)