The curl project has released version 8.23.0 to fix CVE-2026-92392, a use-after-free bug in how curl handles HTTP/2 uploads. When a server resets an upload stream with the reason HTTP_1_1_REQUIRED or REFUSED_STREAM, curl’s cleanup leaves a stale pointer on the old connection, and a later frame from the server can make curl use memory it has already freed. curl’s advisory says the bug has been shown to be convertible into remote code execution on the uploading machine, and the researcher’s public write-up includes a malicious server script.
The attack is demanding. The client must upload a file of roughly 135 KB over HTTP/2 to a server the attacker controls, and that server’s certificate has to pass the client’s checks. Code execution also needs exact knowledge of the target’s curl version, architecture, memory allocator and heap layout, tight timing, and a payload that fits in about 23 bytes. Lead developer Daniel Stenberg wrote that the most likely outcome of an attempted attack is a crash, which is why curl rated the flaw High rather than Critical. It is the project’s first High-severity flaw since the SOCKS5 heap overflow of October 2023. The Hacker News reports no attacks using it. The bug has shipped since curl 8.12.0 in February 2025, and because libcurl is embedded in many programs, the exposure extends beyond the command-line tool. The release fixes 24 CVEs in all; the other 23 are rated Low.
How to check if you’re affected
Affected versions are curl and libcurl 8.12.0 through 8.22.0, built with HTTP/2 support, in both the command-line tool and the library. Run curl --version to see the version and look for HTTP2 in the features line. Applications that bundle their own libcurl need their vendor’s update. Fixes: upgrade to curl 8.23.0, or on older branches to 8.14.3, 8.16.2 or 8.20.2. Debian 13 (trixie) has 8.14.1-2+deb13u7 through DSA-6558-1, and Debian 12 (bookworm) does not carry the vulnerable code, per The Hacker News. If you cannot update yet, curl advises avoiding HTTP/2: use --http1.1 on the command line, or set CURLOPT_HTTP_VERSION to CURL_HTTP_VERSION_1_1 in applications, noting that curl documents this as a request that an existing connection can override. A build without HTTP/2 support cannot reach the vulnerable path.