Is CVE-2026-92390 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92390 being exploited in the wild.

How severe is CVE-2026-92390?

Informational severity, published 20 October 2026.

Which products and versions are affected?

Curl 7.20.0 to 8.22.0, except 8.14.3 (8.14.x branch), 8.16.2 (8.16.x branch), 8.20.2 (8.20.x branch).

How is CVE-2026-92390 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-92390?

Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92390: curl remote-header-name file overwrite bypass

CVE-2026-92390 · Severity: info · Published 2026-10-20

curl is a widely-used command-line tool for downloading files from the internet. When using the -J option (which prevents overwriting existing files), an HTTP server can bypass this protection by sending specific HTTP headers, allowing it to overwrite a local file. This could enable attackers to replace legitimate files with malicious content.

Technologies: Curl. Vendors: Curl.

Quick answers

Is CVE-2026-92390 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92390 being exploited in the wild.
How severe is CVE-2026-92390?: Informational severity, published 20 October 2026.
Which products and versions are affected?: Curl 7.20.0 to 8.22.0, except 8.14.3 (8.14.x branch), 8.16.2 (8.16.x branch), 8.20.2 (8.20.x branch).
Is there a fix for CVE-2026-92390?: Yes: fixed in curl 8.23.0, 8.20.2, 8.16.2, 8.14.3. Until then: Upgrade to the patched version or avoid using the -J (--remote-header-name) option when downloading files from untrusted servers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92390 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-92390?: Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: curl 8.23.0, 8.20.2, 8.16.2, 8.14.3

Upgrade to the patched version or avoid using the -J (--remote-header-name) option when downloading files from untrusted servers.

Technical details

The vulnerability exists in curl's handling of the --remote-header-name (-J) anti-clobbering protection. When a 103 Early Hints response precedes the final HTTP response, or when an ETag header is processed before Content-Disposition under --etag-save, the no-overwrite constraint is bypassed. An unauthenticated attacker controlling an HTTP(S) server can craft responses that exploit this logic flaw to overwrite local files despite the -J protection.

Affected products

curl curl 7.20.0 to 8.22.0, except 8.14.3 (8.14.x branch), 8.16.2 (8.16.x branch), 8.20.2 (8.20.x branch)

Timeline

2026-09-12: disclosed: Vulnerability reported to curl project
2026-10-14: patched: curl 8.23.0 released with fix
2026-10-14: advisory: Security advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.