Vulnerability intelligence
CVE-2026-92392
curl curl
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.
CVSS Score
—
Unrated
EPSS — Exploit Probability
—
Awaiting FIRST.org data · checked 2026-10-14
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
unknown
Check vendor advisories
1 article across 1 outlet · first covered Oct 14, 2026 · latest Oct 14, 2026
Coverage timeline
-
Curl Fixes HTTP/2 Upload Flaw That Could Trigger Memory Corruptionthehackernews.com · Oct 14, 2026