high severityConfidence highHistorical record

Malicious HTTP/2 servers can crash curl during uploads (CVE-2026-92392)

On 2026-10-14 the curl project published CVE-2026-92392 as High: during an HTTP/2 upload, mishandling RST_STREAM with reason HTTP_1_1_REQUIRED or REFUSED_STREAM can use-after-free a struct Curl_easy. The advisory says the UAF has been proven convertible to remote code execution only when many exact criteria line up (curl object layout, architecture, libc heap, nghttp2 and OpenSSL/TLS 1.3 behavior, pinned CA geometry, two parallel transfers, short-command constraint). Affects curl and libcurl 8.12.0 through 8.22.0. Fixed in 8.23.0 (also advisory branch floors 8.14.3, 8.16.2, 8.20.2). Not listed on CISA KEV catalog version 2026.10.13 and no known-in-the-wild mark on the Guard feed at publish time. Oct 14 also shipped 20 Low curl advisories on the same 8.23.0 upgrade train.

Also tracked as CVE-2026-92392 · curl HTTP/2 upload Use-After-Free · libcurl RST_STREAM UAF

First observed
Oct 14, 2026
Last observed
Oct 14, 2026
Last reviewed
Oct 14, 2026
Tracking ended
Oct 14, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

Guard evidence pack still showed Unknown severity / analysis pending at blog publish. Branch tarballs 8.20.2 were not found on curl.se downloads at check time; branch floors are from the advisory text. RCE requires attacker-controlled HTTP/2 upload target plus narrow lab conditions, so blast radius for casual internet worming is limited.

  • Not an internet worm: the attacker must be the HTTP/2 server you are uploading to.
  • curl below 8.12.0 and builds without HTTP2 are out of scope.
  • Not listed on CISA KEV catalog 2026.10.13 at newsroom publish time.

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Covered by Guard

  • provides evidence

    Evidence pack maps the CVE; it does not claim runtime interception of curl uploads on every host.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. First observed

    Issue reported to the curl project (advisory timeline).

  2. Disclosure

    curl 8.23.0 released coordinated with CVE-2026-92392 High advisory (HTTP/2 upload UAF).

  3. Update

    HOL Guard published the operator blog write-up.

Publication clock: 0.5 hours from reviewed disclosure timestamp to HOL publication; 24-hour high target; within target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • curl@>=8.12.0 <=8.22.0genericpackage
  • libcurl@>=8.12.0 <=8.22.0genericpackage

Sources

Every claim on this record is traceable to the sources below.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-9CBC0FA1