A security flaw in curl’s handling of HTTP/2 uploads could allow memory corruption and potential code execution on the client machine when a malicious server accepts an upload.
The issue, described as a use-after-free tracked as CVE-2026-92392, arises during the upload path when the server stalls a transfer by manipulating HTTP/2 flow control and a cleanup step then feeds leftover bytes back into a new request. curl’s lead developer noted that exploitation requires precise knowledge of the target’s curl version, architecture and memory layout, and that, in practice, the most likely outcome is a crash rather than reliable code execution.
The vulnerability affects curl and libcurl 8.12.0 through 8.22.0 (both the command-line tool and the shared library used by many applications). The curl project fixed the flaw in curl 8.23.0, released on 14 October 2026, with a six-line change in lib/multi.c to ensure the HTTP/2 layer releases references to the relevant handle only after leftover upload data has been flushed. The update also ships updated Rock-solid curl long-term releases and addresses 24 CVEs in total (the other 23 rated Low).
No public reports of active exploits were noted at the time of the advisory, though a public HackerOne write-up and a Demonstration PoC were made available on the same day.
Until patched, curl users are advised to avoid HTTP/2 where possible, for example by using --http1.1 or by configuring CURLOT_HTTP_VERSION to CURL_HTTP_VERSION_1_1. For builds, HTTP/2 support is a build option; a build without HTTP/2 cannot reach the vulnerable path. Administrators should upgrade to 8.23.0 or apply the referenced fix to protect systems relying on curl or libcurl.