Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2026-92392: curl can crash or be compromised during file upload
CVE-2026-92392 · published 20 days ago
Summary
When curl handles a file upload over HTTP/2, it can mishandle a reset signal from the server, causing a memory error that may crash the program or allow an attacker to run code. This affects all versions of curl that support HTTP/2. Update curl to the latest patched release to fix the problem.
What to do
- Update debian curl to version 8.14.1-2+deb13u7.
- Update canonical curl to version 8.18.0-1ubuntu2.8.
- Update curl to version 8.14.1-r3.
- Update curl to version 8.14.1-r4.
- Update canonical curl to version 8.20.0-2ubuntu11.1.
- Update curl to version 8.23.0-r0.
- Update bellsoft curl to version 8.23.0-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | curl | curl | <= 8.22.0 |
| Debian:13 | debian | curl |
< 8.14.1-2+deb13u7 Fix: upgrade to 8.14.1-2+deb13u7
|
| Debian:14 | debian | curl | All versions |
| Alpaquita:23 | bellsoft | curl |
>= 8.20.0-r0 >= 8.20.0-r0, < 8.23.0-r0 Fix: upgrade to 8.23.0-r0
|
| Alpaquita:25 | bellsoft | curl |
>= 8.14.0-r1 >= 8.14.0-r1, < 8.23.0-r0 Fix: upgrade to 8.23.0-r0
|
| Alpaquita:stream | bellsoft | curl |
>= 8.12.0-r0 >= 8.12.0-r0, < 8.23.0-r0 Fix: upgrade to 8.23.0-r0
|
| BellSoft Hardened Containers:stream | – | curl |
>= 8.12.0-r0 >= 8.12.0-r0, < 8.23.0-r0 Fix: upgrade to 8.23.0-r0
|
| Ubuntu:26.10 | canonical | curl |
< 8.20.0-2ubuntu11.1 Fix: upgrade to 8.20.0-2ubuntu11.1
|
| Ubuntu:26.04:LTS | canonical | curl |
< 8.18.0-1ubuntu2.8 Fix: upgrade to 8.18.0-1ubuntu2.8
|
| Alpine:v3.21 | – | curl |
< 8.14.1-r3 Fix: upgrade to 8.14.1-r3
|
| Alpine:v3.22 | – | curl |
< 8.14.1-r4 Fix: upgrade to 8.14.1-r4
|
| Alpine:v3.23 | – | curl |
< 8.23.0-r0 Fix: upgrade to 8.23.0-r0
|
Original advisory text
BELL-CVE-2026-92392
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server
(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after
free of a `struct Curl_easy` object.
(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after
free of a `struct Curl_easy` object.
References
- https://curl.se/docs/CVE-2026-92392.json
- https://security-tracker.debian.org/tracker/CVE-2026-92392 Vendor Advisory
- https://hackerone.com/reports/4030333
- https://curl.se/docs/CVE-2026-92392.html Third Party Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-92392 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-92392 Third Party Advisory
- https://security.alpinelinux.org/vuln/CVE-2026-92392 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/18/5
- http://www.openwall.com/lists/oss-security/2026/10/18/6
- https://www.cve.org/CVERecord?id=CVE-2026-92392 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8927-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8927-2 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.1
High
Type
CWE-416Use After Free
Timeline
Published15 Oct 2026
Updated31 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-92392 · NVD
CVE-2026-92392 · MITRE
DEBIAN-CVE-2026-92392 · OSV
CURL-CVE-2026-92392 · OSV
BELL-CVE-2026-92392 · OSV
UBUNTU-CVE-2026-92392 · OSV
ALPINE-CVE-2026-92392 · OSV
Track software like this
Free during beta