{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-9CBC0FA1",
  "slug": "cve-2026-92392-curl-http2-upload-use-after-free",
  "title": "Malicious HTTP/2 servers can crash curl during uploads (CVE-2026-92392)",
  "aliases": [
    "CVE-2026-92392",
    "curl HTTP/2 upload Use-After-Free",
    "libcurl RST_STREAM UAF"
  ],
  "summary": "On 2026-10-14 the curl project published CVE-2026-92392 as High: during an HTTP/2 upload, mishandling RST_STREAM with reason HTTP_1_1_REQUIRED or REFUSED_STREAM can use-after-free a struct Curl_easy. The advisory says the UAF has been proven convertible to remote code execution only when many exact criteria line up (curl object layout, architecture, libc heap, nghttp2 and OpenSSL/TLS 1.3 behavior, pinned CA geometry, two parallel transfers, short-command constraint). Affects curl and libcurl 8.12.0 through 8.22.0. Fixed in 8.23.0 (also advisory branch floors 8.14.3, 8.16.2, 8.20.2). Not listed on CISA KEV catalog version 2026.10.13 and no known-in-the-wild mark on the Guard feed at publish time. Oct 14 also shipped 20 Low curl advisories on the same 8.23.0 upgrade train.",
  "status": "published",
  "severity": "high",
  "confidence": "high",
  "uncertainty": "Guard evidence pack still showed Unknown severity / analysis pending at blog publish. Branch tarballs 8.20.2 were not found on curl.se downloads at check time; branch floors are from the advisory text. RCE requires attacker-controlled HTTP/2 upload target plus narrow lab conditions, so blast radius for casual internet worming is limited.",
  "firstObservedAt": "2026-10-14T08:00:00.000Z",
  "lastObservedAt": "2026-10-14T08:19:55.047Z",
  "publishedAt": "2026-10-14T08:27:34.747Z",
  "reviewedAt": "2026-10-14T08:27:30.325Z",
  "expiresAt": "2026-10-14T08:19:55.047Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "curl-advisory",
      "label": "curl security advisory CVE-2026-92392",
      "url": "https://curl.se/docs/CVE-2026-92392.html",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-10-14T08:00:00.000Z"
    },
    {
      "id": "curl-advisory-json",
      "label": "curl CVE-2026-92392 OSV JSON",
      "url": "https://curl.se/docs/CVE-2026-92392.json",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-10-14T08:00:00.000Z"
    },
    {
      "id": "curl-security-index",
      "label": "curl published vulnerabilities index",
      "url": "https://curl.se/docs/security.html",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-10-14T08:00:00.000Z"
    },
    {
      "id": "fix-commit",
      "label": "curl fix commit 8b0744af5b1b631da5b938ca31c3f9895ad5a321",
      "url": "https://github.com/curl/curl/commit/8b0744af5b1b631da5b938ca31c3f9895ad5a321",
      "sourceType": "other_primary",
      "observedAt": "2026-10-14T08:00:00.000Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL Guard operator write-up",
      "url": "https://hol.org/blog/cve-2026-92392-curl-http2-upload-use-after-free",
      "sourceType": "other_primary",
      "observedAt": "2026-10-14T08:19:55.047Z"
    },
    {
      "id": "hol-guard-pack",
      "label": "HOL Guard CVE evidence pack",
      "url": "https://hol.org/guard/security/cves/CVE-2026-92392-http2-upload-use-after-free",
      "sourceType": "other_primary",
      "observedAt": "2026-10-14T07:46:15.160Z"
    }
  ],
  "artifacts": [
    {
      "id": "curl-main",
      "artifactClass": "package",
      "ecosystem": "generic",
      "name": "curl",
      "version": ">=8.12.0 <=8.22.0",
      "defanged": false
    },
    {
      "id": "libcurl",
      "artifactClass": "package",
      "ecosystem": "generic",
      "name": "libcurl",
      "version": ">=8.12.0 <=8.22.0",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "reported",
      "occurredAt": "2026-09-15T00:00:00.000Z",
      "eventType": "first_observed",
      "summary": "Issue reported to the curl project (advisory timeline).",
      "sourceIds": [
        "curl-advisory"
      ]
    },
    {
      "id": "disclosed",
      "occurredAt": "2026-10-14T08:00:00.000Z",
      "eventType": "disclosure",
      "summary": "curl 8.23.0 released coordinated with CVE-2026-92392 High advisory (HTTP/2 upload UAF).",
      "sourceIds": [
        "curl-advisory",
        "curl-advisory-json"
      ]
    },
    {
      "id": "hol-blog",
      "occurredAt": "2026-10-14T08:19:55.047Z",
      "eventType": "other",
      "summary": "HOL Guard published the operator blog write-up.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [
    {
      "assertionId": "guard-cve-pack",
      "relationship": "provides_evidence",
      "limitation": "Evidence pack maps the CVE; it does not claim runtime interception of curl uploads on every host."
    }
  ],
  "policies": [],
  "limitations": [
    "Not an internet worm: the attacker must be the HTTP/2 server you are uploading to.",
    "curl below 8.12.0 and builds without HTTP2 are out of scope.",
    "Not listed on CISA KEV catalog 2026.10.13 at newsroom publish time."
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-92392-curl-http2-upload-use-after-free/corrections"
}