Use-after-free in cURL - CVE-2026-92392

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in curl's HTTP/2 upload handling when processing server-supplied stream resets during an upload. A remote attacker can send specially crafted HTTP/2 RST_STREAM frames with the HTTP_1_1_REQUIRED or REFUSED_STREAM reason to execute arbitrary code.

The demonstrated exploitation requires knowledge of the exact curl object layout, target architecture, compatible libc allocator and heap layout, and calibrated leak and symbol offsets. It also depends on nghttp2 and OpenSSL/TLS 1.3 allocation behavior, a pinned CA bundle and input-dependent allocation geometry, and the timing of two parallel transfers. The demonstrated exploit has an approximately 23-byte command constraint.

Affected software

How to mitigate CVE-2026-92392

External References

• https://curl.se/docs/CVE-2026-92392.html
• https://github.com/curl/curl/commit/cd9107e0128191b7b5396b

Related Security Bulletins

• Multiple vulnerabilities in cURL
• Debian update for curl