Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-92391

curl_mime_free stack overflow by recursion

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
curl

Description

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

curl curl

Default version status: unaffected

  • 8.22.0 to ≤ 8.22.0affected
  • 8.21.0 to ≤ 8.21.0affected
  • 8.20.0 to ≤ 8.20.0affected
  • 8.19.0 to ≤ 8.19.0affected
  • 8.18.0 to ≤ 8.18.0affected
  • 8.17.0 to ≤ 8.17.0affected
  • 8.16.0 to ≤ 8.16.0affected
  • 8.15.0 to ≤ 8.15.0affected
  • 8.14.1 to ≤ 8.14.1affected
  • 8.14.0 to ≤ 8.14.0affected
  • 8.13.0 to ≤ 8.13.0affected
  • 8.12.1 to ≤ 8.12.1affected
  • 8.12.0 to ≤ 8.12.0affected
  • 8.11.1 to ≤ 8.11.1affected
  • 8.11.0 to ≤ 8.11.0affected
  • 8.10.1 to ≤ 8.10.1affected
  • 8.10.0 to ≤ 8.10.0affected
  • 8.9.1 to ≤ 8.9.1affected
  • 8.9.0 to ≤ 8.9.0affected
  • 8.8.0 to ≤ 8.8.0affected
  • 8.7.1 to ≤ 8.7.1affected
  • 8.7.0 to ≤ 8.7.0affected
  • 8.6.0 to ≤ 8.6.0affected
  • 8.5.0 to ≤ 8.5.0affected
  • 8.4.0 to ≤ 8.4.0affected
  • 8.3.0 to ≤ 8.3.0affected
  • 8.2.1 to ≤ 8.2.1affected
  • 8.2.0 to ≤ 8.2.0affected
  • 8.1.2 to ≤ 8.1.2affected
  • 8.1.1 to ≤ 8.1.1affected
  • 8.1.0 to ≤ 8.1.0affected
  • 8.0.1 to ≤ 8.0.1affected
  • 8.0.0 to ≤ 8.0.0affected
  • 7.88.1 to ≤ 7.88.1affected
  • 7.88.0 to ≤ 7.88.0affected
  • 7.87.0 to ≤ 7.87.0affected
  • 7.86.0 to ≤ 7.86.0affected
  • 7.85.0 to ≤ 7.85.0affected
  • 7.84.0 to ≤ 7.84.0affected
  • 7.83.1 to ≤ 7.83.1affected
  • 7.83.0 to ≤ 7.83.0affected
  • 7.82.0 to ≤ 7.82.0affected
  • 7.81.0 to ≤ 7.81.0affected
  • 7.80.0 to ≤ 7.80.0affected
  • 7.79.1 to ≤ 7.79.1affected
  • 7.79.0 to ≤ 7.79.0affected
  • 7.78.0 to ≤ 7.78.0affected
  • 7.77.0 to ≤ 7.77.0affected
  • 7.76.1 to ≤ 7.76.1affected
  • 7.76.0 to ≤ 7.76.0affected
  • 7.75.0 to ≤ 7.75.0affected
  • 7.74.0 to ≤ 7.74.0affected
  • 7.73.0 to ≤ 7.73.0affected
  • 7.72.0 to ≤ 7.72.0affected
  • 7.71.1 to ≤ 7.71.1affected
  • 7.71.0 to ≤ 7.71.0affected
  • 7.70.0 to ≤ 7.70.0affected
  • 7.69.1 to ≤ 7.69.1affected
  • 7.69.0 to ≤ 7.69.0affected
  • 7.68.0 to ≤ 7.68.0affected
  • 7.67.0 to ≤ 7.67.0affected
  • 7.66.0 to ≤ 7.66.0affected
  • 7.65.3 to ≤ 7.65.3affected
  • 7.65.2 to ≤ 7.65.2affected
  • 7.65.1 to ≤ 7.65.1affected
  • 7.65.0 to ≤ 7.65.0affected
  • 7.64.1 to ≤ 7.64.1affected
  • 7.64.0 to ≤ 7.64.0affected
  • 7.63.0 to ≤ 7.63.0affected
  • 7.62.0 to ≤ 7.62.0affected
  • 7.61.1 to ≤ 7.61.1affected
  • 7.61.0 to ≤ 7.61.0affected
  • 7.60.0 to ≤ 7.60.0affected
  • 7.59.0 to ≤ 7.59.0affected
  • 7.58.0 to ≤ 7.58.0affected
  • 7.57.0 to ≤ 7.57.0affected
  • 7.56.1 to ≤ 7.56.1affected
  • 7.56.0 to ≤ 7.56.0affected

References