curl Fixes High-Severity HTTP/2 Upload Flaw That Researcher Turned Into Code Execution

The curl project has released version 8.23.0 to fix CVE-2026-92392, a use-after-free flaw in how curl and libcurl handle HTTP/2 uploads. A malicious server receiving an upload can corrupt the client's memory, and the researcher who reported the bug turned that into code execution on the uploading machine. curl rates the flaw High, its first High-severity issue since October 2023, and cut its release cycle by two weeks to ship the fix. It affects versions 8.12.0 through 8.22.0, covering both the command-line tool and the library that many other programs use for transfers.

The attack runs from the server side. The client must upload a file of roughly 135KB over HTTP/2 to an attacker-controlled server, and that server's certificate must pass the client's checks. libcurl negotiates HTTP/2 by default for https:// URLs when the server offers it and the library was built with HTTP/2 support. curl notes that taking over a client needs exact knowledge of its build and memory layout, and it expects a real attack to end in a crash instead. No source reports attacks using the flaw in the wild.

The fix is to upgrade to 8.23.0 or apply the fix commit to a local build. If you cannot update yet, curl advises avoiding HTTP/2 by requesting HTTP/1.1 (the --http1.1 option, or CURLOPT_HTTP_VERSION in applications). curl calls that a request, because an existing connection may be reused. Builds without HTTP/2 support cannot reach the affected path. The release fixes 24 CVEs in total; the other 23 are rated Low.