---
title: curl 8.23.0 fixes HTTP/2 upload use-after-free CVE-2026-92392 (High), shown convertible to RCE under narrow conditions | ctxsec
url: https://ctxsec.com/items/curl-cve-2026-92392
description: ""
status: "confirmed (vendor)"
published: 2026-10-14
---

> 

[← Cybersecurity News](/news) · [markdown](/items/curl-cve-2026-92392.md)

confirmed (vendor)

2026-10-14

### curl 8.23.0 fixes HTTP/2 upload use-after-free CVE-2026-92392 (High), shown convertible to RCE under narrow conditions

During HTTP/2 uploads, curl mishandles a server `RST_STREAM` (HTTP_1_1_REQUIRED or REFUSED_STREAM) and frees a transfer object still in use. curl says a malicious server can turn it into code execution only if many specific conditions line up (known build layout, allocator, heap geometry, parallel transfers, ~23-byte command limit). Affects curl/libcurl 8.12.0 through 8.22.0, including the command-line tool. Fix: curl 8.23.0 (released Oct 14) or backports 8.20.2 / 8.16.2 / 8.14.3; workaround: disable HTTP/2. Reported by "Luna with Claude, Anthropic". Remember libcurl is embedded in many products.

Sources: [curl advisory CVE-2026-92392](https://curl.se/docs/CVE-2026-92392.html)