curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
curl patches HTTP/2 upload flaw enabling client-side code execution.
Run curl?
Get an email when a reviewed story names curl, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A critical use-after-free vulnerability (CVE-2026-92392) in curl and libcurl's HTTP/2 upload handling allows a malicious server to corrupt client memory, potentially leading to code execution. The curl project released version 8.23.0 to fix the flaw, which affects versions 8.12.0 through 8.22.0. While exploitation requires specific conditions and knowledge of the client's build, users are advised to upgrade or disable HTTP/2 if unable to patch immediately.
The lesson from this incident
Full lessonA use-after-free vulnerability in curl and libcurl's HTTP/2 upload handling (CVE-2026-92392) allows a malicious server to corrupt client memory and potentially execute arbitrary code on the connecting client. The flaw affects a specific range of curl versions (8.12.0–8.22.0), meaning organizations that do not actively track their open-source library versions are silently exposed. This matters because curl and libcurl are embedded in an enormous number of applications, scripts, and devices, making the blast radius of an unpatched vulnerability exceptionally wide. The availability of a public proof-of-concept dramatically lowers the bar for exploitation, compressing the window between disclosure and active attacks.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
- cve — CVE-2026-92392