curl Fixes High-Severity HTTP/2 Upload Flaw Enabling Remote Code Execution
Anthropic AI scanner uncovers critical use-after-free vulnerability across curl versions 8.12.0 to 8.22.0.
1Critical Vulnerability in curl HTTP/2
The curl project released version 8.23.0 on October 14 to patch CVE-2026-92392, a high-severity use-after-free vulnerability affecting versions 8.12.0 through 8.22.0. The bug allows a malicious HTTP/2 server to corrupt client memory during file uploads, potentially leading to client-side remote code execution on target systems.
2Anatomy of the Exploit
The exploit requires a client uploading approximately 135KB over HTTP/2 to an attacker-controlled server with valid certificates. The malicious server stalls the transfer by zeroing the window size, returns a partial response, and resets the stream. This sequence forces curl into an unexpected retry and error-cleanup state.
3Flawed Transfer Cleanup Mechanism
During cleanup, curl informed the HTTP/2 layer that the transfer ended before flushing unsent data into the connection. These leftover bytes triggered a new stream that retained a dangling pointer to the freed easy handle. When the server later sent a frame, it accessed this already deallocated memory space.
4Exploitation Hurdles and Practical Impact
Achieving reliable code execution requires precise knowledge of the target's heap layout, libc allocator, architecture, and exact curl version. Attackers must also bypass ASLR using leaked addresses and fit payloads into 23 bytes. Lead developer Daniel Stenberg noted that untargeted real-world attack attempts typically trigger application crashes instead.
5Targeted Six-Line Code Fix
Maintainer Stefan Eissing resolved the vulnerability with a concise six-line reordering in lib/multi.c. The patch ensures the HTTP/2 layer releases easy handle references strictly after flushing unsent upload data. The curl project shortened its standard release cycle from eight weeks to six to deliver this critical security update.
6AI Discovery via OSS Scanner
Anthropic researcher Luna Tong identified the flaw using Anthropic's automated OSS Scanner powered by Claude. Reported on September 15 through HackerOne, the security team verified the bug within hours. This discovery represents a rare high-impact valid vulnerability among automated AI bug submissions to the open-source data transfer project.
7Mitigation and Upgrade Guidance
Administrators should immediately upgrade to curl 8.23.0 or apply patches to supported LTS branches. Systems unable to update immediately must disable HTTP/2 by forcing HTTP/1.1 via CLI flags or CURLOPT_HTTP_VERSION configurations. Compiling libcurl without HTTP/2 support also fully mitigates exposure to the vulnerable code path.
8Memory Safety and Architecture Outlook
Despite identifying this use-after-free defect as preventable by memory-safe languages, curl maintainers confirmed no plans for a total rewrite. The project will continue incrementally replacing direct internal handle pointers with robust lookup identifiers. Teams relying on native network libraries must maintain aggressive patching practices for client-side transport stacks.