Skip to content
curl Patches Critical HTTP/2 Upload Flaw with CVE-2026-92392

curl Patches Critical HTTP/2 Upload Flaw with CVE-2026-92392

First seen 14 Oct 2026, 14:37 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 16:34 UTC
  • •CVE-2026-92392 is a critical use-after-free vulnerability in curl affecting versions 8.12.0 to 8.22.0.
  • •The flaw allows remote code execution via HTTP/2 uploads from an attacker-controlled server.
  • •Users are urged to upgrade to curl 8.23.0 or disable HTTP/2 support until patched.

On October 14, 2026, the curl project released version 8.23.0 to address a critical use-after-free vulnerability tracked as CVE-2026-92392. This flaw affects curl and libcurl versions 8.12.0 to 8.22.0, allowing an attacker-controlled server to exploit the vulnerability during HTTP/2 uploads, potentially leading to remote code execution. The vulnerability requires specific knowledge of the client's build and memory layout, making it complex to exploit. No reports of have been confirmed, but the flaw has existed since February 2025. Users are advised to upgrade to the patched version or disable HTTP/2 support until they can update. The release also fixes 24 vulnerabilities in total, with 23 rated as low severity. The advisory and proof-of-concept code were published simultaneously with the patch.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-14
CVE-2026-92392 published
curl released version 8.23.0 to fix a critical use-after-free vulnerability affecting versions 8.12.0 to 8.22.0.
Thehackernews
2026-10-14
Proof of Concept released
A researcher published a proof-of-concept exploit demonstrating the vulnerability's potential for remote code execution.
Sploitus

More articles in this cluster (4)

Following this threat?

Track Debian and CVE-2026-92392 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

Which versions of curl are affected?
curl and libcurl versions 8.12.0 to 8.22.0 are affected by CVE-2026-92392.
What should I do if I can't update immediately?
If you cannot update to version 8.23.0, disable HTTP/2 support in curl to mitigate the risk.
Is there any evidence of exploitation in the wild?
As of now, there are no reports of active exploitation of CVE-2026-92392.