curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution

A use-after-free bug in curl's HTTP/2 upload handling, tracked as CVE-2026-92392, has been fixed in curl 8.23.0 after a researcher built a proof of concept showing it can lead to code execution on the uploading client. The flaw, present since version 8.12.0 (February 2025) through 8.22.0, is triggered when a malicious server stalls an HTTP/2 upload, resets the stream, and reuses stale memory tied to a freed transfer handle, allowing an attacker who knows the client's exact build and memory layout to hijack a function pointer. curl rates the issue High—its first High-severity flaw since 2023's SOCKS5 heap overflow—though it notes a real-world attempt would most likely just crash the client rather than achieve execution. Users should upgrade to curl/libcurl 8.23.0 (or the matching 8.14.3, 8.16.2, 8.20.2 branch releases), or disable HTTP/2 via --http1.1 or CURLOPT_HTTP_VERSION as a stopgap; the release also resolves 23 additional Low-severity CVEs, and curl credits the discovery to a researcher using Anthropic's new opt-in OSS Scanner service.