Curl Patches Critical HTTP/2 Upload Flaw Enabling Client-Side Code Execution
Curl has fixed a critical use-after-free vulnerability in its HTTP/2 upload handling that could allow a malicious server to achieve client-side code execution.
The curl project has released version 8.23.0, patching a critical vulnerability (CVE-2026-92392) that affects both the curl command-line tool and the widely used libcurl library. This flaw, a use-after-free bug in HTTP/2 upload handling, could allow a malicious server to corrupt client memory, potentially leading to client-side code execution. While the vulnerability is rated High by the curl project, successful exploitation requires precise knowledge of the target's build and memory layout, with crashes being the more probable outcome.
The attack vector originates from the server side. An attacker must control the server to which a client is uploading a file over HTTP/2. The server then stalls the upload, resets the stream while keeping the connection open, and tricks curl into treating leftover upload data as a new request. This process can lead to the client's memory being overwritten when the server sends further data on the now-reused connection.
This vulnerability has been present in curl releases from version 8.12.0 (released February 2025) up to 8.22.0. The curl project expedited its release cycle by two weeks to deliver the fix promptly. For users unable to update immediately, curl advises disabling HTTP/2 support by using the --http1.1 option or setting CURLOPT_HTTP_VERSION to CURL_HTTP_VERSION_1_1 in applications using libcurl.
Exploiting this flaw to achieve code execution is complex. It necessitates the attacker knowing the target's exact curl version, architecture, libc allocator, and heap layout. Additionally, precise timing for parallel transfers and fitting the exploit payload into a small memory space are required. Curl's lead developer, Daniel Stenberg, noted that the most likely result of an attempted attack is a system crash rather than successful code execution, which is why the vulnerability was classified as High rather than Critical.
The fix, implemented by Stefan Eissing, involves a minor reordering of operations in lib/multi.c. The HTTP/2 layer now relinquishes its references to the easy handle only after any remaining upload data has been flushed, preventing the use-after-free condition. The vulnerability was reported on September 15th through HackerOne by Luna Tong of Anthropic, whose company's new OSS Scanner tool is believed to have been involved in its discovery.
This incident highlights the ongoing challenges in securing complex software like curl, which is a foundational component for countless applications. The discovery by an AI-assisted tool also underscores the evolving landscape of vulnerability research, where artificial intelligence is playing an increasingly significant role in identifying security flaws.
The curl project has a history of addressing security issues, and this patch is part of their continuous effort to maintain the integrity and security of their software. Users are strongly encouraged to update to version 8.23.0 or the relevant patched versions for older supported branches to mitigate this risk.