curl/libcurl: Use-after-free in HTTP/2 upload handling

Summary

curl and libcurl mishandle HTTP/2 RST_STREAM frames with the reason HTTP_1_1_REQUIRED or REFUSED_STREAM that a server sends during an upload. This leads to a use-after-free of a struct Curl_easy object. An attacker needs a malicious HTTP/2 server that the client uploads data to. The vendor says the flaw may be convertible to remote code execution, but only if many specific conditions are met.

Affected

• curl 8.12.0 up to and including 8.22.0 (command line tool and libcurl)
• Not affected: curl before 8.12.0, curl 8.23.0 and later, and the fixed branch releases 8.20.2 (8.20.X), 8.16.2 (8.16.X) and 8.14.3 (8.14.X)

Fixed in

• Upgrade to curl 8.23.0 (released 14 October 2026)
• Or apply the vendor patch
• Distribution packages differ; check your distributor's security tracker for the exact package version

Workaround

• The vendor advisory lists no workaround.
• Third-party sources suggest avoiding HTTP/2 or forcing HTTP/1.1 (for example with curl --http1.1). The vendor has not confirmed this; test before relying on it.

Exploitation

• No evidence of in-the-wild exploitation or public exploit code was found at publication.
• CISA SSVC assessment: exploitation status PoC, not automatable, total technical impact.
• The vendor states that conversion to remote code execution requires many specific conditions, such as exact build, heap layout and timing.

Our recommendation

• Inventory all curl and libcurl installations, including embedded copies in runtimes, containers and appliances.
• Upgrade to curl 8.23.0 or the fixed branch release, or install the fixed distribution package.
• Prioritise hosts that upload over HTTP/2 to external or untrusted endpoints.
• Until patched, restrict uploads to trusted endpoints and monitor curl-based applications for crashes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  ashu7ank/CVE-2026-92392

Research sources

• curl security advisory CVE-2026-92392 curl.se
• curl advisory JSON metadata curl.se
• HackerOne original report hackerone.com
• Debian security tracker security-tracker.debian.org
• Ubuntu security notice ubuntu.com
• OpenCVE CVE-2026-92392 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:08.