{"id":"CURL-CVE-2026-92392","summary":"HTTP/2 upload Use-After-Free","details":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.","aliases":["CVE-2026-92392"],"modified":"2026-10-14T19:02:59.327877991Z","published":"2026-10-14T08:00:00Z","database_specific":{"last_affected":"8.22.0","severity":"High","package":"curl","affects":"both","URL":"https://curl.se/docs/CVE-2026-92392.json","www":"https://curl.se/docs/CVE-2026-92392.html","issue":"https://hackerone.com/reports/4030333","CWE":{"id":"CWE-416","desc":"Use After Free"}},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"8.12.0"},{"fixed":"8.14.3"},{"introduced":"8.15.0"},{"fixed":"8.16.2"},{"introduced":"8.17.0"},{"fixed":"8.20.2"},{"introduced":"8.21.0"},{"fixed":"8.23.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"cd9107e0128191b7b5396b9eb81bbd20c2d36755"},{"fixed":"8b0744af5b1b631da5b938ca31c3f9895ad5a321"}]}],"versions":["8.22.0","8.21.0","8.20.0","8.19.0","8.18.0","8.17.0","8.16.0","8.15.0","8.14.1","8.14.0","8.13.0","8.12.1","8.12.0","rc-8_23_0-3","rc-8_23_0-2","rc-8_23_0-1","curl-8_22_0","rc-8_22_0-3","rc-8_22_0-2","rc-8_22_0-1","curl-8_21_0","rc-8_21_0-3","rc-8_21_0-2","rc-8_21_0-1","curl-8_20_0","rc-8_20_0-3","rc-8_20_0-2","rc-8_20_0-1","curl-8_19_0","rc-8_19_0-3","rc-8_19_0-2","rc-8_19_0-1","curl-8_18_0","rc-8_18_0-3","rc-8_18_0-2","rc-8_18_0-1","curl-8_17_0","curl-8_16_0","curl-8_15_0","curl-8_14_1","curl-8_14_0","curl-8_13_0","curl-8_12_1","curl-8_12_0"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/curl/curl.git/commit/8b0744af5b1b631da5b938ca31c3f9895ad5a321","target":{"file":"lib/multi.c"},"deprecated":false,"digest":{"line_hashes":["172238863165931586668982930997595353493","218845954258016969779822574619198913116","337529673480845593698953231070394427799","174084796602386981149832587286974444859","2589360371253289306928639858185432264","79748790196713297325660114299508034201","51119311107506160698695312696183053597","5983876337283450776812460309599988868","289921439291985099166765432424288842986","242133792126884807747264957942781445513","36108613980205627487300486555621638973","323318115706619218177629457227671569154","285833209863991848862864053724717642695","55886213651525042844780387216536066794"],"threshold":0.9},"id":"CURL-CVE-2026-92392-85f53260","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/8b0744af5b1b631da5b938ca31c3f9895ad5a321","target":{"file":"lib/multi.c","function":"multi_done"},"deprecated":false,"digest":{"function_hash":"24696468084555479272929369446571393409","length":1402},"id":"CURL-CVE-2026-92392-ae3da486"}],"vanir_signatures_modified":"2026-10-14T19:02:59Z","source":"https://curl.se/docs/CURL-CVE-2026-92392.json"}}],"schema_version":"1.9.0","credits":[{"name":"Luna with Claude","type":"FINDER"},{"name":"Anthropic","type":"FINDER"},{"name":"Stefan Eissing","type":"REMEDIATION_DEVELOPER"}]}