Vulnerability in curl

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR14 Oct 2026CERTFR-2026-AVI-1307

  Multiple vulnerabilities in Curl Translated from French

  Multiple vulnerabilities have been discovered in Curl. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and a breach of data confidentiality.

  CVE-2026-94265CVE-2026-87863CVE-2026-107928+23 more CVEs
• BSI CERT-Bund13 Oct 2026WID-SEC-2026-3904

  cURL: Multiple vulnerabilities Translated from German

  CVE-2026-87861CVE-2026-86412CVE-2026-92391+20 more CVEs

[ References ]References

• curl.se/docs/CVE-2026-92392.html
• curl.se/docs/CVE-2026-92392.json
• hackerone.com/reports/4030333
• www.openwall.com/lists/oss-security/2026/10/18/5
• www.openwall.com/lists/oss-security/2026/10/18/6