curl Patches HTTP/2 Upload Flaw Allowing Client-Side Code Execution

Critical HTTP/2 Vulnerability Addressed

The curl project has released version 8.23.0 to patch a significant security flaw, tracked as CVE-2026-92392. This use-after-free vulnerability affects curl and libcurl versions 8.12.0 through 8.22.0. The flaw allows a malicious server to corrupt a client's memory during an HTTP/2 upload, with a proof-of-concept demonstrating client-side code execution.

Attack Vector and Prerequisites

The attack is server-side, requiring the client to upload approximately 135KB of data over HTTP/2 to an attacker-controlled server. The server's certificate must also pass the client's validation checks. libcurl negotiates HTTP/2 by default for HTTPS URLs when available and built with HTTP/2 support. The vulnerability has been present in all curl releases since 8.12.0 in February 2025, though no active exploitation reports exist.

Remediation and Mitigation

Users are advised to upgrade to curl 8.23.0 immediately. Fixes are also available for older branches: 8.14.3 for the 8.14.x branch, 8.16.2 for 8.16.x, and 8.20.2 for 8.20.x. Debian 13 (trixie) users should update to 8.14.1-2+deb13u7 via DSA-6558-1. For those unable to update, a temporary workaround is to disable HTTP/2 by using the `--http1.1` option for the command-line tool or setting `CURLOPT_HTTP_VERSION` to `CURL_HTTP_VERSION_1_1` in applications.

Broader Impact of the Release

The 8.23.0 release addresses a total of 24 CVEs, with CVE-2026-92392 being the only one rated as High severity by curl. The remaining 23 vulnerabilities are rated Low. This is the first High-severity flaw for curl since a SOCKS5 heap overflow discovered in October 2023, prompting the project to accelerate its release cycle by two weeks to deliver the fix promptly.