Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-92392

HTTP/2 upload Use-After-Free

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
curl

Description

During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

curl curl

Default version status: unaffected

  • 8.22.0 to ≤ 8.22.0affected
  • 8.21.0 to ≤ 8.21.0affected
  • 8.20.0 to ≤ 8.20.0affected
  • 8.19.0 to ≤ 8.19.0affected
  • 8.18.0 to ≤ 8.18.0affected
  • 8.17.0 to ≤ 8.17.0affected
  • 8.16.0 to ≤ 8.16.0affected
  • 8.15.0 to ≤ 8.15.0affected
  • 8.14.1 to ≤ 8.14.1affected
  • 8.14.0 to ≤ 8.14.0affected
  • 8.13.0 to ≤ 8.13.0affected
  • 8.12.1 to ≤ 8.12.1affected
  • 8.12.0 to ≤ 8.12.0affected

References