curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution

A high-severity use-after-free vulnerability in curl and libcurl, tracked as CVE-2026-92392, allows a malicious HTTP/2 server to achieve client-side code execution during file uploads under specific conditions. The flaw affects versions 8.12.0 through 8.22.0 and was patched in version 8.23.0. Successful exploitation requires precise knowledge of the client's build, architecture, and memory layout, making reliable code execution difficult; crashes are more likely than full compromise. The vulnerability was discovered via Anthropic's OSS Scanner and reported through HackerOne by researcher Luna Tong.

AI-extracted · verify before operational use