curl Fixes HTTP/2 Upload Flaw That Could Let Malicious Servers Run Code on Clients

What the curl HTTP/2 Upload Flaw Involved

curl, a widely used tool and library for transferring data, has patched a serious vulnerability in how it handles HTTP/2 uploads. According to The Hacker News↗ (opens in a new tab), the flaw allowed a server receiving an upload to corrupt the memory of the client machine. A researcher demonstrated that this could be used to execute code on the client's computer, though the curl team says a real attack would almost always just crash the program.

The bug, tracked as CVE-2026-92392, affected both the curl command-line tool and the libcurl library in versions 8.12.0 through 8.22.0. Many other programs use libcurl for file transfers, so the impact could be broad. The fix was released on 14 October 2026 in curl 8.23.0. The project cut its usual release cycle short to address the issue quickly.

Who Is at Risk and What Should You Do?

Anyone using curl or libcurl versions 8.12.0 to 8.22.0 with HTTP/2 support enabled could be affected. The attack requires the client to upload a file of about 135KB to a server controlled by the attacker, and the server's certificate must pass the client's checks. By default, libcurl negotiates HTTP/2 for HTTPS URLs if the server offers it and the library is built with HTTP/2 support.

curl recommends upgrading to version 8.23.0 or applying the fix to your local build. For those who cannot update immediately, the advice is to avoid using HTTP/2 by forcing HTTP/1.1 (using the --http1.1 option in curl or setting CURLOPT_HTTP_VERSION to CURL_HTTP_VERSION_1_1 in applications). Debian 13 users should install the security update, while Debian 12 is not affected.

How the Attack Works

The flaw is a use-after-free bug. In simple terms, this means the program tries to use memory after it has been released, which can lead to crashes or, in rare cases, let an attacker run their own code. Here, a malicious server can stall an upload, then reset the connection in a way that confuses curl. This causes curl to reuse memory that has already been freed. If the attacker knows the exact details of the client's system and times things perfectly, they can use this to overwrite a function pointer and potentially run code on the victim's machine.

However, the exploit is complex. It requires precise knowledge of the client's curl version, system architecture, memory layout, and more. The curl team says the most likely outcome is a crash rather than successful code execution.

Timeline and Response

The vulnerability was reported to curl on 15 September 2026 via HackerOne. The curl team confirmed it within hours and released a fix on 14 October 2026, two weeks ahead of schedule. The researcher credited is Luna Tong of Anthropic, who used Anthropic's new OSS Scanner tool to find the bug. The public write-up and a proof-of-concept were released alongside the fix.

No attacks using this flaw have been reported in the wild. The curl project rates the severity as High (its first High since October 2023), but not Critical, due to the difficulty of a real-world exploit. The fix itself is a small change in the code that ensures memory is not reused in this risky way.

Lessons and Broader Context

The curl team notes that this kind of bug is a risk in code written in languages like C, which do not automatically manage memory. They say a memory-safe language would likely have prevented the issue, but there are no plans to rewrite curl. The project has been working to reduce similar risks by changing how it handles internal pointers.

This incident highlights the importance of prompt patching and careful memory management in widely used software. It also shows the growing role of automated tools, including AI, in finding security flaws in open-source projects.