Is CVE-2026-92392 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92392 being exploited in the wild.

How severe is CVE-2026-92392?

High severity, with a CVSS score of 8.1, published 14 October 2026.

How is CVE-2026-92392 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-92392?

Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92392: curl HTTP/2 upload use-after-free

CVE-2026-92392 · Severity: high · CVSS 8.1 · Published 2026-10-14

curl, a widely-used file transfer and data retrieval tool, mishandles certain HTTP/2 error responses during file uploads, causing it to use memory after it has been freed. A malicious server can trigger this flaw to crash curl or potentially execute arbitrary code on the uploading system if very specific conditions are met.

Technologies: Curl. Vendors: Curl.

Quick answers

Is CVE-2026-92392 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92392 being exploited in the wild.
How severe is CVE-2026-92392?: High severity, with a CVSS score of 8.1, published 14 October 2026.
Which products and versions are affected?: Curl 8.12.0 to 8.22.0.
Is there a fix for CVE-2026-92392?: Yes: fixed in curl 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch). Until then: Do not use HTTP/2 for uploads until curl is upgraded, or disable HTTP/2 support in applications using curl. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92392 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-92392?: Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: curl 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch)

Do not use HTTP/2 for uploads until curl is upgraded, or disable HTTP/2 support in applications using curl.

Technical details

A use-after-free vulnerability in curl's HTTP/2 handling occurs when the server sends a RST_STREAM frame with reason codes HTTP_1_1_REQUIRED or REFUSED_STREAM during an upload. The freed struct Curl_easy object is subsequently accessed, leading to memory corruption. While the vulnerability requires a malicious or compromised server and precise heap conditions for code execution, the basic flaw is reachable over the network during any HTTP/2 upload.

Affected products

curl curl 8.12.0 to 8.22.0

Timeline

2026-10-14: disclosed
2026-10-14: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.