CURL has released version 8.23.0 to fix a use-after-free vulnerability in HTTP/2 file uploads, tracked as CVE-2026-92392. The issue could allow a malicious server to trigger a memory fault on client devices initiating uploads, potentially enabling remote code execution under specific conditions. The flaw affects cURL and libcurl installations with HTTP/2 support enabled and active file uploads.
Versions affected are 8.12.0 through 8.22.0, with the vulnerability disclosed by the project's advisory as requiring precise environmental factors such as target software version, CPU architecture, memory allocator, and heap layout timing to achieve exploitation. The issue is rated high severity, though public reports indicate that credible exploitation would more likely cause client crashes rather than straightforward arbitrary code execution.
The advisories recommend upgrading to cURL 8.23.0 to fully remediate the flaw. If immediate patching is not feasible, administrators can disable HTTP/2 support, or force HTTP/1.1 by using the –http1.1 option for command-line use, or by restricting protocol version in applications using libcurl. At present, there are no confirmed reports of active exploitation, with the CVSS score listed as 8.1 (High, CVSSv3) and an EPSS of 0.2% over 30 days.
The article emphasises following the vendor advisory for guidance and confirms that the vulnerability stems from a dangling reference after processing an HTTP/2 stream reset frame.