CVE-2026-92391: curl_mime_free stack overflow by recursion
A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within curlmimefree leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.
Other sources
curlmimefree stack overflow by recursion
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.23.0-1 - Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 8.23.0-r0 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.58.0-2ubuntu3.24+esm15 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.68.0-1ubuntu2.25+esm10 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.81.0-1ubuntu1.30 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.5.0-2ubuntu10.16 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.20.0-2ubuntu11.1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.18.0-1ubuntu2.8 - Upgrade
Upgrade
azurelinux/curlto a version that resolves this vulnerability.Fixed in 8.11.1-13
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger the crash?
They must be able to cause the application to construct a deeply nested multipart MIME structure through libcurl's public API. The stack overflow occurs when libcurl performs normal cleanup of that structure.
What is the expected impact of successful exploitation?
The excessive recursion in curl_mime_free exhausts stack space and crashes the host process. The provided information describes a denial-of-service condition.