During HTTP/2 uploads, curl mishandles a server RST_STREAM (HTTP_1_1_REQUIRED or REFUSED_STREAM) and frees a transfer object still in use. curl says a malicious server can turn it into code execution only if many specific conditions line up (known build layout, allocator, heap geometry, parallel transfers, ~23-byte command limit). Affects curl/libcurl 8.12.0 through 8.22.0, including the command-line tool. Fix: curl 8.23.0 (released Oct 14) or backports 8.20.2 / 8.16.2 / 8.14.3; workaround: disable HTTP/2. Reported by "Luna with Claude, Anthropic". Remember libcurl is embedded in many products.