CVE-2026-92392
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.
- CVSS
- —
- EPSS
- —
- CISA KEV
- Not listed
- Exploitation
- No report
- Public exploits
- None seen
- State
- PUBLISHED
Coverage
OMG! Ubuntu / It's FOSS News / 9to5Linux / Fedora Magazine / Ubuntu Blog / Arch News / Debian NewsSpecialist. Specialist publisher: established trade press, or expert analysis with a track record
Fixes available for CVE-2026-92392 and other curl vulnerabilities
Introduction On 7 October 2026, Daniel Stenberg published a blog post describing a plan to release a new version of curl on 14 October 2026 in order to address 22 known security vulnerabilities. These vulnerabilities have varying severities, with a single vulnerability assessed as high…
What we observed
No signals recorded