CVE-2026-92392

Published Oct 14, 2026

Last updated 3 days ago

CVSS high 8.1
Libcurl

Overview

Description
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.
Source
2499f714-1537-4658-8207-48ae4bb9eae9
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
8.1
Impact score
5.9
Exploitability score
2.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-416

Social media

Hype score
Not currently trending

  1. Anthropic'in Yapay Zekâ Destekli Açık Kaynak Tarayıcısı, curl'de İstemci Tarafında Kod Çalıştırmaya Dönüştürülebilen Bir Bellek Açığı Buldu! curl ve libcurl'ün HTTP/2 yükleme işlemlerindeki use-after-free açığı CVE-2026-92392, Anthropic çalışanı L

    @BTHaberler

    20 Oct 2026

    50 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  2. curl's first High flaw in 1,099 days was in 13 releases; curl lists eight conditions for code execution 616 days. 13 releases. Eight conditions. One label. curl 8.23.0 shipped on 14 October with a fix for CVE-2026-92392, a use-after-free in HTTP/2 uploads. curl rates it High,

    @_pksharma

    14 Oct 2026

    47 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.•CVE-2026-82208
  2. A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.•CVE-2026-80255
  3. When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.•CVE-2026-8926
  4. When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.•CVE-2026-8927
  5. libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.•CVE-2026-8932

References

Sources include official advisories and independent security research.