Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorscurl has fixed a high-severity use-after-free in HTTP/2 upload handling after a proof of concept showed that a malicious receiving server could reach client-side code execution in tightly controlled conditions. The practical response is to update curl or libcurl, or force affected uploads to HTTP/1.1 until a fixed build is deployed.
What CVE-2026-92392 affects
CVE-2026-92392 affects both the curl command-line program and applications that embed libcurl. The vulnerable range is curl and libcurl 8.12.0 through 8.22.0. The curl project published the advisory on October 14, 2026, after the issue was reported on September 15.
As an Amazon Associate I earn from qualifying purchases.
Fixed versions are 8.23.0, 8.14.3, 8.16.2 and 8.20.2, depending on the maintenance branch used by your distribution or product. A vendor package may carry the fix under a distribution-specific version number, so package changelogs and security trackers matter as much as the upstream version string.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The defect is in HTTP/2 upload processing. A client has to upload data to a server controlled by the attacker, the connection has to use HTTP/2, and the server certificate must pass the client’s normal certificate checks. Ordinary HTTP/1.1 transfers do not follow this code path.
#1 Best Overall
Why the severity is High, not an automatic Critical
The reporter demonstrated a path from the memory-safety bug to client-side remote code execution. That demonstration depended on unusually precise knowledge of the target: the exact curl version and structure layout, CPU architecture, libc allocator behavior, heap arrangement, allocation effects from nghttp2 and OpenSSL, the geometry of a pinned CA bundle, timing across two transfers, and calibrated memory-leak and symbol offsets.
The public exploit also limits the command it can deliver to approximately 23 bytes. Daniel Stenberg, curl’s lead developer, said the most likely result of an attempted attack is a crash. The independent report describing the flaw said it had no reports of attacks using it. No broader prevalence figure, exploitation count or CVSS score was published with the available coverage.
Rank #2
- Comes with secure packaging
- It can be a gift item
- Easy to read text
How the HTTP/2 use-after-free happens
- The server stalls the upload. It advertises an HTTP/2 flow-control window of zero, preventing the client from completing the upload, while returning part of a response.
- The server resets the stream. It sends an HTTP/2
RST_STREAMwith reasonHTTP_1_1_REQUIREDorREFUSED_STREAM. curl treats that reset as retryable and keeps the underlying connection available. - Cleanup runs in the wrong order. curl marks the transfer finished before all remaining upload bytes have been flushed into the shared connection. Those bytes can then be parsed as a new request.
- A stale stream reference remains. The newly parsed stream still points to the original
struct Curl_easy. If the application frees that easy handle, a later HTTP/2 frame can dereference the freed object. - The proof of concept turns memory corruption into execution. Server-controlled data is placed in the freed area, a request is used to leak local addresses and defeat address-space layout randomization, and a function pointer is overwritten before curl calls it.
The independent exploit description used an upload of roughly 135 KB. That figure describes the reported scenario, not a universal trigger size.
What changed in the fix
The upstream correction is a six-line reorder in lib/multi.c. The HTTP/2 layer now releases its references to the easy handle only after leftover upload data has been flushed into the shared connection. That ordering prevents the connection from creating work that still points at an object the application has already freed.
Rank #3
What administrators and developers should do
Upgrade the standalone curl tool
- Check the installed release with
curl --version. - If it is between 8.12.0 and 8.22.0, install curl 8.23.0 or the fixed maintenance-branch build supplied by your operating-system vendor.
- Restart scripts, services or containers that use the replaced binary so they do not continue running an older copy.
Update applications using libcurl
Updating only the command-line executable does not protect a service that links to a separate libcurl library. Rebuild or replace the library in every application image, appliance, agent and statically linked binary that embeds it, then restart those processes.
Use HTTP/1.1 as a temporary mitigation
The command-line option --http1.1 requests HTTP/1.1 instead of HTTP/2. In an application, request CURL_HTTP_VERSION_1_1. This removes the vulnerable HTTP/2 upload path, but it can change connection behavior and eliminate HTTP/2 multiplexing, so test upload workflows and throughput before making it a permanent policy.
Backport the patch when an upgrade is not immediate
A local backport of the upstream change is a valid short-term option for a controlled build, but it requires rebuilding and redeploying every affected curl or libcurl consumer. It should be tracked as a temporary measure until a maintained fixed release is available.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallChoosing a response for each deployment
| Response | Patch completeness | HTTP/2 exposure | Deployment scope | Compatibility trade-off |
|---|---|---|---|---|
| Upgrade to 8.23.0 or a fixed branch release | Complete upstream fix | HTTP/2 can remain enabled | Requires updating the curl binary and every libcurl consumer | Preserves normal protocol features |
| Apply the upstream reorder locally | Fix is present, but maintenance is yours | HTTP/2 can remain enabled | Must rebuild and redeploy each custom build | Requires patch validation and future merge work |
| Force HTTP/1.1 | Does not repair the vulnerable code | HTTP/2 upload path is avoided | Can be set per command or in application configuration | May remove multiplexing and alter performance or server compatibility |
Release context and limits of the disclosure
Version 8.23.0 fixed 24 CVEs in total. The curl project rated the other 23 issues Low; CVE-2026-92392 is the exceptional High-severity issue in that release. The advisory describes the flaw as “a C mistake (likely to have been avoided had we not been using C).”
The available reports establish a credible, demonstrated exploit path, not evidence that all HTTP/2 uploads are being attacked. They also do not establish how many systems are exposed or whether exploitation is occurring in the wild. Organizations should therefore treat the issue as a patching priority without assuming that every failed HTTP/2 upload indicates compromise.
Quick Recap
Checks after remediation
- Confirm the runtime version of both the curl executable and the libcurl library actually loaded by each service.
- Review whether any component statically links an older copy that a package upgrade did not replace.
- Search configuration and code for forced HTTP/2 settings and decide whether temporary HTTP/1.1 fallback is needed during rollout.
- Retest uploads, retries, proxy paths and certificate pinning after the change, because the reported attack requires a validly authenticated TLS connection and a server-controlled upload endpoint.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
