curl 8.23.0, released 14 October, fixes CVE-2026-92392, a High-severity use-after-free in HTTP/2 uploads. It is the first High curl flaw since the SOCKS5 heap overflow in October 2023. The project cut its release cycle by two weeks to ship the fix.

What happened

During an upload, curl mishandles an HTTP/2 RST_STREAM from the server when the reason is HTTP_1_1_REQUIRED or REFUSED_STREAM. That frees a Curl_easy object while a pointer to it is still used. A malicious server that receives the upload can then write into that memory.

The curl project says the bug can become remote code execution only if the attacker knows the exact build, architecture, allocator, and heap layout, keeps two transfers timed correctly, and fits the payload into about 23 bytes. The client must actually upload, roughly 135 KB, to a server whose certificate the client already trusts. curl expects a real attack to crash more often than it runs code. No in-the-wild exploitation has been reported. The finder is credited as Luna with Claude at Anthropic. Affected versions are curl and libcurl 8.12.0 through 8.22.0. Builds before 8.12.0, and 8.23.0 and later, are not affected. Selected older branches are also patched: 8.20.2, 8.16.2, and 8.14.3 and later on those lines.

Who is affected

Anything that links libcurl and uploads over HTTP/2, not just the curl binary. Scripts, package managers, backup agents, and appliance firmware often ship a stale libcurl.

• curl and libcurl 8.12.0 through 8.22.0 built with HTTP/2 support.
• Applications that POST or PUT to third-party or user-supplied HTTPS endpoints.
• Images and appliances that vendor curl and will not pick up a distro update on their own.

What to do now

Upgrade to curl 8.23.0, or to the patched point release on your branch. If you cannot upgrade today, disable HTTP/2 for transfers you do not fully trust. Inventory appliances and containers separately from the OS package, because a host that shows 8.23.0 can still ship an old libcurl inside a vendor image.

Source: curl project advisory, 14 October 2026. HTTP/2 upload Use-After-Free.

Also on the blog

• Ivanti Connect Secure CVE-2026-104935 exploited, patch by 16 Oct
• CVE-2026-96951: Windows MotW bypass exploited, patch by 16 Oct
• Microsoft seizes YAM Store phishing kits behind 1 billion messages
• Ampath breach: attacker claims 80 million records, lab disputes count

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.