CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints

Published Oct 20, 2026

Updated

When invoked with --remote-header-name (-J), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the Content-Disposition header despite the presence of the -J non-overwrite constraint.

Affected Software

1 affected component

curl curl

Event History

Oct 20, 2026

CVE Published

via MITRE·08:23 PM

Data Sourced

via MITRE·08:23 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users running curl with --remote-header-name (-J) against an HTTP or HTTPS server are exposed when that server can send a Content-Disposition filename. The bypass is triggered when an intermediate 103 Early Hints response precedes the final response, or when an ETag is processed before Content-Disposition while --etag-save is in use.

What must an attacker control to exploit the overwrite?

The attacker needs to control, or be able to influence, the HTTP(S) server response headers, including the Content-Disposition filename. They must also cause the affected response ordering involving 103 Early Hints or ETag handling with --etag-save.

Are default curl invocations affected?

The described condition requires --remote-header-name (-J). The provided information does not indicate that curl is affected without this option.

What can be done if patching is not immediately possible?

Avoid using --remote-header-name (-J) with untrusted servers, especially where 103 Early Hints responses may be present. Avoid combining -J with --etag-save when the server controls Content-Disposition filenames.

CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker control to exploit the overwrite?

Are default curl invocations affected?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker control to exploit the overwrite?

Are default curl invocations affected?

What can be done if patching is not immediately possible?