curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution

Summary: A use-after-free flaw in curl's HTTP/2 upload handling, tracked as CVE-2026-92392, affects curl and libcurl 8.12.0 through 8.22.0 and was fixed in curl 8.23.0 on October 14. The reporter, credited as Luna Tong of Anthropic via its OSS Scanner, demonstrated client-side code execution with a malicious server, though curl says an attack most likely ends in a crash and requires exact knowledge of the target's build, architecture, libc allocator and heap layout, plus a payload of about 23 bytes.
What you should know: libcurl negotiates HTTP/2 by default for https:// URLs when the server offers it, so any program built with HTTP/2 support that uploads roughly 135KB to an attacker-controlled server with a valid certificate reaches the vulnerable path. The fix is a six-line reorder in lib/multi.c, and curl's fallback advice if you cannot update is to disable HTTP/2 entirely.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-92392
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026