CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints
-J no-clobber guarantee bypassed with 103 early hints
Other sources
When invoked with --remote-header-name (-J), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the Content-Disposition header despite the presence of the -J non-overwrite constraint.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.23.0-1 - Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 8.23.0-r0 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.20.0-2ubuntu11.1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.18.0-1ubuntu2.8
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running curl with --remote-header-name (-J) against an HTTP or HTTPS server are exposed when that server can send a Content-Disposition filename. The bypass is triggered when an intermediate 103 Early Hints response precedes the final response, or when an ETag is processed before Content-Disposition while --etag-save is in use.
What must an attacker control to exploit the overwrite?
The attacker needs to control, or be able to influence, the HTTP(S) server response headers, including the Content-Disposition filename. They must also cause the affected response ordering involving 103 Early Hints or ETag handling with --etag-save.
Are default curl invocations affected?
The described condition requires --remote-header-name (-J). The provided information does not indicate that curl is affected without this option.
What can be done if patching is not immediately possible?
Avoid using --remote-header-name (-J) with untrusted servers, especially where 103 Early Hints responses may be present. Avoid combining -J with --etag-save when the server controls Content-Disposition filenames.