Full Report
A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned that into code execution on the uploading machine. The curl project fixed it on October 14 in curl 8.23.0. Taking over a client needs exact knowledge of its build and memory layout, and curl expects a real attack to end in a crash
Analysis Summary
# Vulnerability: curl HTTP/2 Upload Use-After-Free RCE
## CVE Details
- **CVE ID:** CVE-2026-92392
- **CVSS Score:** N/A (Rated **High** by curl project)
- **CWE:** CWE-416 (Use After Free)
## Affected Systems
- **Products:** curl (command-line tool) and libcurl (library)
- **Versions:** 8.12.0 through 8.22.0
- **Configurations:** Systems built with HTTP/2 support performing uploads to a malicious server using the HTTP/2 protocol.
## Vulnerability Description
The flaw exists in the way curl handles HTTP/2 upload retries. When a server stalls an upload (setting the window to zero) and then resets the stream while keeping the connection open, curl attempts to retry the transfer. During this process, leftover bytes from the unsent upload are incorrectly read as a new request. This opens a new stream that maintains a pointer to an "easy handle" (transfer object).
When the application finishes the retry on a separate connection, it frees the original handle. However, the initial connection retains the dangling pointer. A malicious server can then send frames that land in the memory formerly occupied by that freed handle, leading to memory corruption and potential Remote Code Execution (RCE).
## Exploitation
- **Status:** PoC available (Included in HackerOne report 4030333; features a malicious server script and Docker reproduction).
- **Complexity:** High (Requires exact knowledge of the client’s build and memory layout to achieve RCE; otherwise likely results in a crash).
- **Attack Vector:** Network (Malicious server-to-client).
## Impact
- **Confidentiality:** High (Successful exploitation can leak local addresses to defeat ASLR).
- **Integrity:** High (Ability to overwrite function pointers and execute arbitrary code).
- **Availability:** High (Attacks failing to achieve RCE will cause the client application to crash).
## Remediation
### Patches
Upgrade to the following versions or higher:
- **Mainline:** curl 8.23.0
- **Branch 8.14.x:** 8.14.3
- **Branch 8.16.x:** 8.16.2
- **Branch 8.20.x:** 8.20.2
- **Debian 13:** 8.14.1-2+deb13u7 (via DSA-6558-1)
### Workarounds
- **Force HTTP/1.1:** Use the `--http1.1` flag in the command line or set `CURLOPT_HTTP_VERSION` to `CURL_HTTP_VERSION_1_1` in applications.
- **Disable HTTP/2:** Recompile curl/libcurl without HTTP/2 support.
## Detection
- **Indicators of Compromise:** Unusual HTTP/2 stream resets followed by unexpected data frames from the server during an upload session.
- **Detection methods:** Monitor for crashes in applications utilizing libcurl during file upload operations, specifically when communicating with external or untrusted endpoints.
## References
- **Vendor Advisory:** [https://curl.se/docs/CVE-2026-92392.html](https://curl.se/docs/CVE-2026-92392.html)
- **Technical Breakdown:** [https://daniel.haxx.se/blog/2026/10/14/a-uaf-turned-rce/](https://daniel.haxx.se/blog/2026/10/14/a-uaf-turned-rce/)
- **HackerOne Report:** [https://hackerone.com/reports/4030333](https://hackerone.com/reports/4030333)
- **Fix Commit:** [https://github.com/curl/curl/commit/8b0744af5b1b631da5b938ca31c3f9895ad5a321](https://github.com/curl/curl/commit/8b0744af5b1b631da5b938ca31c3f9895ad5a321)