CVE-2026-92392

Name of the Vulnerable Software and Affected Versions curl versions 8.12.0 through 8.22.0

Description A use-after-free memory corruption issue exists during HTTP/2 uploads. The flaw occurs when curl mishandles an HTTP/2 RST STREAM response received from a server with the reason HTTP 1 1 REQUIRED or REFUSED STREAM, leading to a use-after-free of a struct Curl easy object. A remote attacker controlling a malicious server can exploit this to cause a client crash or, under highly specific conditions involving precise knowledge of the target's architecture, memory layout, and TLS configuration, achieve remote code execution.

Recommendations Upgrade curl to version 8.23.0. As a temporary mitigation, disable HTTP/2 for affected transfers.