← Thursday, October 15, 2026SecurityVulnerability

curl HTTP/2 upload use-after-free could lead to remote code execution

daniel.haxx.se 6 min read Editor score 7/10

A use-after-free in curl's HTTP/2 upload handling could lead to remote code execution; the write-up explains how it happened and discusses prevention work. Its reproducible report offers useful lessons for maintainers of network-facing C software.

What: curl 8.23.0 fixed a HIGH-severity HTTP/2 upload use-after-free, CVE-2026-92392.
How: After a server resets an upload stream, cleanup can leave a dangling easy-handle pointer; later data handling can reuse its memory and leak client details.
Why it matters: For engineers, the bug shows how asynchronous protocol events and handle lifetimes can combine into memory-safety and information-disclosure flaws.

An HTTP/2 upload and server reset trigger the sequence behind curl's dangling-pointer bug. Sketched from the article's own text.

Read on daniel.haxx.se → Lobsters · 5 comments

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.