cURL Releases Version 8.23.0 to Fix Critical Flaw

The widely deployed open-source project cURL recently released version 8.23.0. This vital update remedies a use-after-free flaw during HTTP/2 file uploads, tracked as CVE-2026-92392. Under specific operational conditions, threat actors can convert this memory corruption into client-side code execution. Consequently, a malicious server can trigger a severe memory fault on client devices initiating uploads.

Affected Versions and Upload Prerequisites

According to the official security advisory, cURL addressed the CVE-2026-92392 vulnerability across all installations. This defect affects cURL and libcurl versions 8.12.0 through 8.22.0. Both the command-line utility and third-party software integrating the shared library are vulnerable. However, the build must have HTTP/2 support enabled to trigger the flaw. Furthermore, the client must actively initiate a file upload to an adversary-controlled server. When cURL processes an incoming HTTP/2 stream reset frame, it retains a reference to the freed transfer object. As a result, this dangling reference creates a classic use-after-free condition.

Remote Code Execution Feasibility and Constraints

Public security reports demonstrate viable reproduction methods that transform this memory flaw into remote code execution. Nevertheless, achieving arbitrary code execution requires meeting stringent environmental criteria. Specifically, attackers must determine the target software version, CPU architecture, memory allocator, and exact heap layout. Moreover, they must precisely manipulate the timing of concurrent transfers. The project maintainers rated the issue as high severity. However, they noted that real-world exploits are far more likely to trigger immediate client crashes.

Immediate Remediation and Workarounds

Fortunately, upgrading directly to cURL version 8.23.0 completely resolves this flaw. If immediate patching is impractical, administrators should disable HTTP/2 support entirely. For command-line operations, users can append the –http1.1 flag to force HTTP/1.1 connections. Similarly, software applications utilizing libcurl can explicitly set version options to restrict protocol usage.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.