The curl project released curl 8.23.0 with a fix for CVE-2026-92392, an HTTP/2 upload use-after-free issue affecting curl and libcurl 8.12.0 through 8.22.0. Reporting says a proof of concept demonstrated a path to client-side code execution under specific conditions.
What is affected
The impact extends beyond the curl command-line utility. libcurl is embedded in many applications and products, so asset owners should use software inventories and supplier notices to determine exposure.
Defender checklist
- Update curl and libcurl to 8.23.0 or a vendor-provided fixed build.
- Identify applications that statically bundle or depend on libcurl.
- Prioritize systems that make HTTP/2 uploads to untrusted or externally controlled services.
- Validate updates in critical services and track exceptions until they can be remediated.
Although practical exploitation may depend on target-specific conditions, a memory-safety issue in widely deployed transfer software warrants timely patching.
Source: The Hacker News.