CVE Feed

    Dashboard / CVE / CVE-2026-92392

    CVE-2026-92392

    During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.

    Published:Oct 14, 2026
    Last Modified:Oct 20, 2026
    EPS:Oct 14, 2026
    EPSS Score:0.00855
    CVSS Score:8.1

    Affected Products

    Vendor
    Curl
    Product
    Curl
    Vendor
    Redhat
    Product
    Hummingbird

    Exploits

    https://github.com/ashu7ank/CVE-2026-92392

    Common Weakness Enumeration

    CWE-416 Use After Free

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-86410 (CVSS 8.1) — A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting …
    CVE-2026-94266 (CVSS 7.5) — libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing…
    CVE-2026-87862 (CVSS 8.1) — Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child.…
    CVE-2026-92391 (CVSS 7.5) — A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl dur…
    CVE-2026-86409 (CVSS 8.1) — Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and do…
    CVE-2026-94265 (CVSS 9.1) — When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might er…
    CVE-2026-86415 (CVSS 7.5) — libcurl's connection cache match function never considers the automatic client certificate option, so a cached…
    CVE-2026-87861 (CVSS 9.1) — When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connectio…
    CVE-2026-92387 (CVSS 8.1) — By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can explo…
    CVE-2026-92390 (CVSS 7.5) — When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protect…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High