{"id":3531,"date":"2026-10-14T14:05:34","date_gmt":"2026-10-14T14:05:34","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3531"},"modified":"2026-10-14T14:05:34","modified_gmt":"2026-10-14T14:05:34","slug":"curl-patches-http-2-upload-flaw-after-poc-demonstrates-client-side-code-execution","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3531","title":{"rendered":"curl Patches HTTP\/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution"},"content":{"rendered":"
\n
<\/a><\/div>\n

A flaw in how curl handles HTTP\/2 uploads lets a malicious server receiving an upload corrupt the client’s memory, and the researcher who reported it turned that into code execution on the uploading machine.<\/p>\n

The curl project fixed it on October 14 in curl 8.23.0<\/a>. Taking over a client needs exact knowledge of its build and memory layout, and curl expects a real attack to end in a crash instead.<\/p>\n

The flaw, a use-after-free tracked as CVE-2026-92392<\/a>, affects curl and libcurl 8.12.0 through 8.22.0, both the command-line tool and the library that many other programs use for transfers. curl rates it High on its own four-level scale, its first High-severity flaw since the SOCKS5 heap overflow of October 2023. The project cut its release cycle by two weeks to ship the fix.<\/p>\n

The attack runs from the server side. The client has to upload a file of roughly 135KB over HTTP\/2 to a server controlled by the attacker, and the server’s certificate must pass the client’s checks. libcurl negotiates HTTP\/2 by default for https:\/\/ URLs when the server offers it, and the library was built with HTTP\/2 support.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The flaw has shipped in every curl release since 8.12.0 in February 2025. No source reports attacks that use it. The reporter’s HackerOne write-up<\/a>, with the malicious server script and a Docker container described as reproducing the code execution, became public on October 14 with the advisory.<\/p>\n

What to Install, and What to Do Until Then<\/h3>\n

<\/p>\n

Upgrade to 8.23.0 or apply the fix commit<\/a> to a local build. curl’s machine-readable advisory<\/a> also lists fixed versions on three older branches, and the project said it would ship updated Rock-solid curl<\/a> releases, its long-term-support line for customers with support contracts, in step with 8.23.0:<\/p>\n