REDHAT-BUG-2548642: Use After Free
During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server (with reason HTTP11REQUIRED or REFUSEDSTREAM) leading to a use after free of a struct Curleasy object.
INFO ----
This Use-After-Free flaw has been proven to be possible to convert into a Remote Code Execution if a set of specific criteria are met by the malicious server:
- the exact curl version object and structure layout used for the transfer is known and used to derive attack offsets; - exact architecture details of the running curl needs to be known - a known and compatible libc allocator build and heap layout - nghttp2 and OpenSSL/TLS 1.3 behavior, including allocation effects around session tickets - a pinned CA bundle and other input-dependent allocation geometry - two parallel transfers and their scheduling/timing need to remain - correctly calibrated libc leak and symbol offsets; and - the exploit's current short-command constraint (approximately 23 bytes).
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-92392 to this issue.
CWE-416: Use After Free
Severity: High
This bug is considered a C mistake (likely to have been avoided had we not been using C).
AFFECTED VERSIONS -----------------
- Affected versions: curl 8.12.0 to and including 8.22.0 - Not affected versions: curl < 7.12.0 and >= 8.23.0 - Introduced-in: https://github.com/curl/curl/commit/cd9107e0128191b7b5396b
libcurl is used by many applications, but not always advertised as such!
This flaw also affects the curl command line tool.
SOLUTION --------
- Fixed-in: https://github.com/curl/curl/commit/
RECOMMENDATIONS ---------------
A - Upgrade curl to version 8.23.0
B - Apply the patch to your local version
C - Do not use HTTP/2
TIMELINE --------
This issue was reported to the curl project on September 15, 2026.
curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.
CREDITS -------
- Reported-by: Luna with Claude, Anthropic - Patched-by: Stefan Eissing
Thanks a lot!
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
curlto a version that resolves this vulnerability.Fixed in 8.23.0 - Configuration
Do not use HTTP/2.
curl/libcurl HTTP/2 = disabled
Event History
Frequently Asked Questions
What traffic pattern is required for exploitation?
The issue occurs during an upload over HTTP/2 when the server sends an RST_STREAM with either the HTTP_1_1_REQUIRED or REFUSED_STREAM reason. A malicious or compromised server would need to induce this condition.
How practical is remote code execution from this flaw?
Remote code execution has been demonstrated only when numerous environment-specific conditions are known and controlled, including the exact curl object layout, architecture, libc allocator and heap layout, nghttp2 and TLS 1.3 allocation behavior, and transfer timing. The described exploit also requires two parallel transfers and is currently limited to short commands of approximately 23 bytes.
What deployment details increase the exploit's feasibility?
The attacker needs knowledge of the precise curl version and structure layout, the system architecture, compatible libc details and symbol offsets, and allocation geometry affected by factors such as a pinned CA bundle. These requirements make exploitation dependent on the target's specific runtime environment.