curl HTTP/2 upload UAF turned RCE (CVE-2026-92392)

What it is

CVE-2026-92392 is a use-after-free in libcurl's HTTP/2 upload path, titled "HTTP/2 upload Use-After-Free". It was fixed in curl 8.23.0, and the curl project grades it HIGH, not CRITICAL. Daniel Stenberg calls it one of the worst curl vulnerabilities in a long time. Luna Tong at Anthropic reported it on 15 September 2026, found with Anthropic's OSS Scanner. The curl security team confirmed it within hours.

How it works

1. An application uploads over HTTP/2. This is the default for HTTPS URLs when the server agrees.
2. The server zeroes the HTTP/2 window to pause the upload, returns part of a response, then resets the stream. The connection stays up.
3. curl ends the transfer but leaves a dangling pointer to the easy handle.
4. The application frees the easy handle, then cleans up the multi handle.
5. During multi cleanup, libcurl allocates a download buffer and follows the dangling pointer. It also sends a request that leaks local address details, which an attacker needs to defeat ASLR.
6. Server data lands in the memory that held the easy handle and overwrites a function pointer. libcurl then calls that pointer, which runs attacker code.

Preconditions / Affected

The page lists these conditions for successful code execution:

• The victim uploads to a malicious server, and the server certificate must remain valid.
• The upload is roughly 135KB.
• The attacker knows curl's architecture well enough to build the payload.
• The allocation sequence and sizes line up. This varies by Linux distribution, libc, TLS certificate bundle and the application using libcurl.
• nghttp2 and OpenSSL/TLS 1.3 behaviour, including allocation effects from session tickets, cooperates.
• The payload area is only about 23 bytes.

The page does not say which releases before 8.23.0 are affected.

What to do

Upgrade to curl/libcurl 8.23.0 or later. Stenberg says the project is replacing internal handle pointers with transfer identifiers that are looked up on demand. This is slightly slower but safer against lifetime mistakes. The project is also adding tests and static analysis.

Caveats

Stenberg expects the most likely result of an attack to be a crash, and rates the chance of a successful attack as slim. The project publishes no CVSS score. Stenberg states that this fix does not guarantee the absence of other use-after-free bugs. The curl project has no plan to rewrite libcurl in a memory-safe language. The full report and a reproducible Docker image are linked from the original post.