CVE-2026-92392: HTTP/2 upload Use-After-Free
Published Oct 14, 2026
·Updated
During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server (with reason HTTP11REQUIRED or REFUSEDSTREAM) leading to a use after free of a struct Curleasy object.
Affected Software
2 affected componentsFixes available
curl curl
debian/curl<=8.14.1-2+deb13u5, <=8.22.0-1
7.88.1-10+deb12u157.88.1-10+deb12u58.14.1-2+deb13u78.23.0-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u15Fixed in 7.88.1-10+deb12u5Fixed in 8.14.1-2+deb13u7Fixed in 8.23.0-1
Event History
Oct 14, 2026
CVE Published
via MITRE·07:46 AM
Data Sourced
via MITRE·07:46 AM
DescriptionWeakness
Data Sourced
via Ubuntu·02:50 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·02:50 PM
Description
Data Sourced
via Debian·02:51 PM
DescriptionAffected Software
Frequently Asked Questions
1
What must an attacker control to trigger this issue?
The attacker needs to act as, or control, an HTTP/2 server that receives an upload from curl. That server must send an RST_STREAM frame with either the HTTP_1_1_REQUIRED or REFUSED_STREAM reason during the upload.
2
Are non-upload HTTP/2 requests affected?
The described condition occurs during an upload. The provided information does not indicate that HTTP/2 requests without an upload trigger the use-after-free.