curl Fixes HTTP/2 Upload Flaw That Can Enable Client-Side Code Execution

Summary

A use-after-free in curl and libcurl 8.12.0–8.22.0 can let a malicious HTTP/2 server corrupt an uploading client’s memory and potentially execute code. curl fixed the flaw in 8.23.0; no attacks are reported.

Key points

CVE-2026-92392 affects curl and libcurl versions 8.12.0 through 8.22.0 and is rated High by the curl project.
An attacker-controlled server must receive an approximately 135KB upload over HTTP/2, with its certificate accepted by the client.
The flaw is a use-after-free: after a stream reset and retry, an old connection can retain and later use a pointer to a freed transfer handle.
The researcher demonstrated code execution, but exploitation requires precise knowledge of the target and timing; curl says a crash is the more likely outcome.
curl fixed the issue in version 8.23.0 by reordering cleanup; users can also apply the fix commit or, temporarily, avoid HTTP/2.
The project reports no attacks exploiting the flaw. The report was submitted through HackerOne on September 15 and made public with the October 14 release.

Article Details

Vulnerability Types: Use-after-free
Severity: High
Affected Versions: curl 8.12.0 through 8.22.0
libcurl 8.12.0 through 8.22.0
Exploitation Status: not_reported
Exploit Availability: public_poc
Patch Status: available
Workarounds: Avoid HTTP/2: use --http1.1 with the curl command-line tool or set CURLOPT_HTTP_VERSION to CURL_HTTP_VERSION_1_1 in applications.
Build libcurl without HTTP/2 support.