curl 8.23.0 fixes high-severity HTTP/2 flaw that can enable code execution
curl released version 8.23.0 to fix CVE-2026-92392, a use-after-free flaw affecting HTTP/2 uploads in curl and libcurl. The curl project says a malicious server can turn the bug into remote code execution under specific conditions, but the most likely result of an attempted attack is a crash.
Bottom line — Upgrade to curl 8.23.0; the release fixes 24 CVEs, including CVE-2026-92392.
Go deeper 7
-
The flaw was reported on 15 September 2026 by Luna Tong at Anthropic, using the company’s OSS Scanner, according to curl’s project lead.
-
CISO AI reports that versions 8.12.0 through 8.22.0 are affected, including the command-line tool and libcurl.
-
CISO AI says the attack requires an upload of roughly 135 KB to an attacker-controlled server and a certificate that passes the client’s checks.
-
The curl project says successful code execution requires specific conditions and is extremely difficult to achieve in the wild.
-
CISO AI reports no known attacks using the flaw in the wild; curl’s lead says a crash is the more likely outcome.
-
CISO AI says users unable to update can request HTTP/1.1, though curl warns an existing connection may be reused.
-
The curl project shortened its release cycle by two weeks to ship the fix, and says the update also addresses other vulnerabilities and bugs.