Uncontrolled Recursion in cURL - CVE-2026-92391
Published: October 14, 2026
Vulnerability identifier: #VU155674
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-92391
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in libcurl's curl_mime_free function when traversing deeply nested multipart MIME structures during cleanup. A local user can construct a deeply nested multipart MIME structure through the public API to cause a denial of service.
Triggering the flaw requires thousands of nested MIME parts, with the exact threshold depending on the system and configuration. The curl command line tool is not affected.
Affected software
cURL
How to mitigate CVE-2026-92391
Install security update from vendor's website.
cURL - update to 8.23.0