Most vulnerability briefings assume the reader is defending a server. curl's October release breaks that assumption. CVE-2026-92392 is a use-after-free that a malicious server triggers inside the client. The party you have to distrust is whoever answers your HTTPS request.

The bug in one paragraph

curl 8.23.0, released 14 October 2026, carries 24 security fixes: 23 rated Low, one rated High. The High is CVE-2026-92392. It affects HTTP/2 uploads and triggers when a server answers an upload stream with RST_STREAM while presenting either HTTP_1_1_REQUIRED or REFUSED_STREAM. libcurl then frees the struct Curl_easy handle for the transfer but leaves a code path that still touches it. The use-after-free happens in the client process, while parsing the server's response, before any application logic sees a return value.

Affected versions are 8.12.0 through 8.22.0 inclusive, and the command-line tool is affected alongside the library. An attacker needs a valid certificate for a host the client will talk to, plus knowledge of the target's heap layout. The demonstration payload is roughly 23 bytes. Exploitation in the wild is a research-grade exercise rather than a script, and a naive attempt most likely crashes the client. A likely crash is not a mitigation, though, and the same researchers reported demonstrating code execution.

Why this deserves more attention than its rating suggests

Three features separate CVE-2026-92392 from the steady stream of Low-severity curl CVEs.

The first is the direction of trust. Nearly every hardening guide is written for the case where an attacker sends you a request. Here the attacker sends you a response, and it needs a certificate that a browser or a well-configured client would accept. Anyone who fetches user-supplied URLs, mirrors third-party artifacts, or runs scheduled jobs against endpoints chosen by someone else already satisfies the precondition.

The second is reach. libcurl is embedded in more software than most organisations can enumerate: package managers, language runtimes, database clients, CI runners, backup agents, IoT firmware, and the curl binary inside container images nobody rebuilt. The affected range spans fourteen minor versions, roughly a year of vendors shipping whatever was current at build time.

The third is that the fix is cheap and the backports exist. Fixed in 8.23.0, with backports in 8.20.2, 8.16.2 and 8.14.3. Ubuntu published USN-8927-1 with a CVSS 3.1 score of 8.1. Where a distribution backport exists, the work is an ordinary package update.

The immediate mitigation, and what it costs

The advisory's workaround is to refuse HTTP/2 for uploads. On the command line that is --http1.1; in code, CURLOPT_HTTP_VERSION set to CURL_HTTP_VERSION_1_1. Either form forces the transfer onto HTTP/1.1, where the vulnerable RST_STREAM handling does not exist.

The cost is throughput on large uploads and, in some environments, a proxy that no longer negotiates as it used to. For agents that upload occasionally, that is a fine bridge for the few days it takes to get a patched library into the image. For high-volume pipelines it is a bridge, not a destination.

Inventory work that actually finds the copies

Updating the curl package on the host is the easy half. The copies that matter are statically linked or bundled.

  • Ask each language runtime what it links. Python's pycurl, PHP's ext-curl, Go programs built with cgo, and .NET native dependencies each carry their own copy, sometimes vendored at a version nobody recorded.

  • Check container base images by tag and by digest. A rebuilt image with the same tag is not the same bits.

  • Look at scheduled jobs and integrations that fetch attacker-influenced URLs. Those are the places where the server-side attacker model is already true today.

  • Record the libcurl version each component reports, not the version of the curl binary in PATH. The two diverge constantly.

What the release says about discovery

Twenty of the 24 CVEs in 8.23.0 were found with AI assistance, 18 credited to AISLE and 2 to Anthropic. That is worth noting for what it implies about volume: parsing-layer bugs in mature C libraries are exactly the kind of thing that scales with machine-assisted review. The cost is triage load, since 281 bug fixes and 476 commits accompany those 24 advisories in one release.

Companion issues in the same batch each deserve a line. CVE-2026-86414 leaks proxy credentials. CVE-2026-94266 leaks netrc entries. CVE-2026-87864 is an IMAP injection reachable through CURLOPT_CRLF. CVE-2026-92388 is an FTP use-after-free. SMB and SMB(S) support was removed entirely, and CURL_GLOBAL_WIN32 was renamed to CURL_GLOBAL_WINSOCK.

References

  • curl, CVE-2026-92392 advisory: https://curl.se/docs/CVE-2026-92392.html

  • curl 8.23.0 changelog: https://curl.se/ch/8.23.0.html

  • Ubuntu, USN-8927-1: https://ubuntu.com/security/notices/USN-8927-1