CVE-2026-92392

HTTP/2 upload Use-After-Free

No known exploitation. EPSS puts it in the 58th percentile. No fix published yet.

CVSS 3.18.1High EPSS percentile58th0.9% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-10-14Updated 2026-10-18Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

CurlAffected: ≥ 8.22.0, ≤ 8.22.0Upgrade to: after 8.22.0Affected: ≥ 8.21.0, ≤ 8.21.0Upgrade to: after 8.21.0Affected: ≥ 8.20.0, ≤ 8.20.0Upgrade to: after 8.20.0Affected: ≥ 8.19.0, ≤ 8.19.0Upgrade to: after 8.19.0 + 9 more branchesStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your software, scripts, or internal tools use curl to upload files over HTTP/2 to external or untrusted servers.
Check your installed curl version (curl --version) and ask vendors of any product bundling curl whether they're affected.
Update to the latest curl release that includes the October 14, 2026 fix as soon as your vendor or OS provides it — no specific fixed version number has been published yet, so watch for your distribution's security advisory.
Until updated, avoid using curl to upload files to servers you don't fully trust, especially over HTTP/2.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.

In plain language

Written by AI from the record

This flaw lets a malicious or compromised server crash the curl tool/library when a file upload happens over HTTP/2, and because curl is used inside so much other software, most businesses should check if it affects them.

Use-after-free in curl's HTTP/2 upload handling (CWE-416), triggered when a server sends a RST_STREAM with HTTP_1_1_REQUIRED or REFUSED_STREAM during an upload, freeing a Curl_easy object that is later accessed, with a public PoC demonstrating client-side code execution potential.

If you're affected

Application crashes during uploads
Service disruption
Potential code execution risk
Impact on any tool using curl

What is it

curl is a small, widely-used tool that many programs rely on behind the scenes to send and receive files over the internet. This bug is like a delivery worker who gets confused when a building's front desk refuses a package in a particular way — the confusion causes the worker to grab a box that's already been thrown away, which can crash the whole operation or, in the worst case, be tricked into doing something harmful.

Who is affected

This matters to you if any software you run — websites, scripts, backend services, or installed applications — uses curl to upload files, since curl is embedded in a huge range of products beyond just the command-line tool. It only becomes a real risk if that upload is going over HTTP/2 to a server that an attacker controls or has compromised, since the malicious response is what triggers the crash.

How urgent is it

Attackers haven't been confirmed exploiting this yet, but a public demonstration already shows the flaw can be pushed toward code execution, not just a crash, which makes this a serious, actively-researched weakness. Given curl's presence in so much software and the lack of a confirmed fixed version to point to yet, this needs prompt attention rather than being left for routine patch cycles.

What to do — in detail

Inventory where curl is used — directly (CLI scripts, cron jobs) and indirectly (bundled in applications, containers, language runtimes like PHP/Python/Node that use libcurl bindings) — with particular attention to any workflow that uploads files over HTTP/2 to external endpoints.
Confirm exposure by checking if the upload target could ever send a RST_STREAM with HTTP_1_1_REQUIRED or REFUSED_STREAM during the stream — this is most relevant for clients uploading to third-party or attacker-influenced servers.
Track curl's official release notes/security advisory for the fix shipped October 14, 2026; no clean fixed-version number is confirmed in current findings, so monitor curl.se/docs/security and your distro's advisories closely.
As a temporary workaround, force affected clients to use HTTP/1.1 (--http1.1 or equivalent library option) for upload operations until the patched curl build is deployed.
No CISA KEV listing exists, so there's no federal remediation deadline, but prioritize this given the PoC toward code execution.
After patching, monitor for unexpected curl crashes or core dumps during upload operations as a sign of exploitation attempts.

Technical context

CVSS 3.1 score 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity and availability impact via network attack with high complexity, no privileges or user interaction needed. The weakness is CWE-416 (use-after-free) in curl's HTTP/2 stream handling, where a server-sent RST_STREAM carrying HTTP_1_1_REQUIRED or REFUSED_STREAM during an active upload frees a Curl_easy struct that is subsequently dereferenced. Not in CISA KEV; EPSS places exploitation likelihood at the 50th percentile with a flat trend, indicating moderate but unconfirmed real-world exploitation probability. No public exploit code is on record, though press reporting describes a PoC demonstrating potential client-side code execution beyond simple denial-of-service, suggesting exploit maturity is progressing from PoC toward weaponization.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS58th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.9% chance of exploitation activity in the next 30 days, which ranks it in the 58th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising, driven by in-the-wild reports.

Lifecycle

7 events over 8 days, from the signal feeds we watch.

2026-10-22OpenVAS check added
2026-10-18Record updated
2026-10-15Record updated
2026-10-14Publishedweakness classified, att&ck mapped, record updated

Affected products

curloss-project · USaka libcurl, wcurl
- curlLibraryLibraryOSS Libraries / generic-library

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable