cURL and libcurl6 min read
A UAF turned RCE
In the curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as CVE-2026-92392 with the title HTTP/2 upload Use-After-Free.
By daniel.haxx.se via olliejLobsters
Read the full story
Originally published by Lobsters on Oct 14, 2026.
Comments
Sign in to join the discussion.