Vulnerability in curl

[ Description ]Official description

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR14 Oct 2026CERTFR-2026-AVI-1307

  Multiple vulnerabilities in Curl Translated from French

  Multiple vulnerabilities have been discovered in Curl. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and a breach of data confidentiality.

  CVE-2026-94265CVE-2026-87863CVE-2026-107928+23 more CVEs
• BSI CERT-Bund13 Oct 2026WID-SEC-2026-3904

  cURL: Multiple vulnerabilities Translated from German

  CVE-2026-87861CVE-2026-86412CVE-2026-92391+20 more CVEs

[ References ]References

• curl.se/docs/CVE-2026-92390.html
• curl.se/docs/CVE-2026-92390.json
• hackerone.com/reports/4023192