A defensive checker for CVE-2026-92392, an HTTP/2 upload use-after-free in curl and libcurl.
The flaw is triggered when a curl or libcurl client uploads over HTTP/2 and an attacker-controlled server returns `RST_STREAM` with `REFUSED_STREAM` or `HTTP_1_1_REQUIRED`.
This tool identifies affected builds, records HTTP/2 evidence, and separates binary applicability from application runtime exposure.
Do not scan a remote web server by sending it requests. Assess the host, container, or application runtime that uses curl or libcurl to make outbound uploads.
The tool does not generate an RCE payload and does not target remote hosts. Its optional active probe binds only to `127.0.0.1`.
A release number cannot prove that a vendor did not backport the patch without changing the displayed version.
- `openssl` is required only for `--active --tls`
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
