{"type":"bundle","id":"bundle--0cf4cda0-86d6-5eb1-8ed9-ed086da84558","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--5e5cfdda-6a3c-503f-a62a-b4c3f7f3f000","created":"2026-10-14T08:27:34.747Z","modified":"2026-10-14T08:27:34.747Z","name":"Malicious HTTP/2 servers can crash curl during uploads (CVE-2026-92392)","description":"On 2026-10-14 the curl project published CVE-2026-92392 as High: during an HTTP/2 upload, mishandling RST_STREAM with reason HTTP_1_1_REQUIRED or REFUSED_STREAM can use-after-free a struct Curl_easy. The advisory says the UAF has been proven convertible to remote code execution only when many exact criteria line up (curl object layout, architecture, libc heap, nghttp2 and OpenSSL/TLS 1.3 behavior, pinned CA geometry, two parallel transfers, short-command constraint). Affects curl and libcurl 8.12.0 through 8.22.0. Fixed in 8.23.0 (also advisory branch floors 8.14.3, 8.16.2, 8.20.2). Not listed on CISA KEV catalog version 2026.10.13 and no known-in-the-wild mark on the Guard feed at publish time. Oct 14 also shipped 20 Low curl advisories on the same 8.23.0 upgrade train.","aliases":["CVE-2026-92392","curl HTTP/2 upload Use-After-Free","libcurl RST_STREAM UAF"],"first_seen":"2026-10-14T08:00:00.000Z","last_seen":"2026-10-14T08:19:55.047Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"curl security advisory CVE-2026-92392","url":"https://curl.se/docs/CVE-2026-92392.html"},{"source_name":"curl CVE-2026-92392 OSV JSON","url":"https://curl.se/docs/CVE-2026-92392.json"},{"source_name":"curl published vulnerabilities index","url":"https://curl.se/docs/security.html"},{"source_name":"curl fix commit 8b0744af5b1b631da5b938ca31c3f9895ad5a321","url":"https://github.com/curl/curl/commit/8b0744af5b1b631da5b938ca31c3f9895ad5a321"},{"source_name":"HOL Guard operator write-up","url":"https://hol.org/blog/cve-2026-92392-curl-http2-upload-use-after-free"},{"source_name":"HOL Guard CVE evidence pack","url":"https://hol.org/guard/security/cves/CVE-2026-92392-http2-upload-use-after-free"}]}]}