A recent vulnerability discovered in curl’s handling of HTTP/2 uploads has been patched following the demonstration of a potential client-side code execution. This flaw, identified by a researcher, allowed a malicious server to corrupt the client’s memory during an upload.
Details of the Vulnerability
The curl project addressed this vulnerability on October 14 with the release of version 8.23.0. Exploiting this flaw requires precise knowledge of the client’s build and memory layout, making it more likely to cause a crash rather than successful code execution. The issue, identified as a use-after-free vulnerability (CVE-2026-92392), affects curl and libcurl versions 8.12.0 to 8.22.0.
Rated as High severity by curl, this is the most significant vulnerability since a similar incident in October 2023. The project expedited its release schedule to address the issue promptly.
Impact and Mitigation Strategies
The attack involves uploading a file around 135KB over HTTP/2 to a server controlled by an attacker. The server’s certificate must pass client checks, and the upload is negotiated over HTTP/2 by default when the protocol is supported.
Users are advised to update to version 8.23.0 or apply the fix to their local builds. curl has also provided updates for older versions and long-term-support branches. Until users can update, curl recommends disabling HTTP/2.
Technical Analysis and Future Outlook
The vulnerability involves a server-side attack where the server manipulates the HTTP/2 window, stalls the transfer, and resets the stream. This leads to the client retrying the upload, potentially reading unsent bytes as a new request. Successful exploitation requires detailed knowledge of the target’s system and precise timing.
The vulnerability was reported on September 15 and confirmed swiftly by curl’s security team. The fix, implemented by Stefan Eissing, involved a minor modification in the lib/multi.c file, which ensures that references are released only after all upload data is processed.
This incident highlights the ongoing challenges in maintaining software security, particularly with complex protocols like HTTP/2. The involvement of Anthropic’s OSS Scanner in discovering this flaw underscores the growing role of AI in identifying vulnerabilities.
As curl continues to enhance its codebase, security remains a top priority, with efforts to reduce internal pointers and increase memory safety. However, the project acknowledges that complete prevention of such issues may require more fundamental changes.
