{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92392", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "state": "PUBLISHED", "assignerShortName": "curl", "dateReserved": "2026-09-16T08:12:53.407Z", "datePublished": "2026-10-14T07:46:15.160Z", "dateUpdated": "2026-10-15T10:28:17.201Z"}, "containers": {"cna": {"title": "HTTP/2 upload Use-After-Free", "descriptions": [{"lang": "en", "value": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-10-14T07:46:15.160Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-416 Use After Free"}]}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"version": "8.22.0", "status": "affected", "lessThanOrEqual": "8.22.0", "versionType": "semver"}, {"version": "8.21.0", "status": "affected", "lessThanOrEqual": "8.21.0", "versionType": "semver"}, {"version": "8.20.0", "status": "affected", "lessThanOrEqual": "8.20.0", "versionType": "semver"}, {"version": "8.19.0", "status": "affected", "lessThanOrEqual": "8.19.0", "versionType": "semver"}, {"version": "8.18.0", "status": "affected", "lessThanOrEqual": "8.18.0", "versionType": "semver"}, {"version": "8.17.0", "status": "affected", "lessThanOrEqual": "8.17.0", "versionType": "semver"}, {"version": "8.16.0", "status": "affected", "lessThanOrEqual": "8.16.0", "versionType": "semver"}, {"version": "8.15.0", "status": "affected", "lessThanOrEqual": "8.15.0", "versionType": "semver"}, {"version": "8.14.1", "status": "affected", "lessThanOrEqual": "8.14.1", "versionType": "semver"}, {"version": "8.14.0", "status": "affected", "lessThanOrEqual": "8.14.0", "versionType": "semver"}, {"version": "8.13.0", "status": "affected", "lessThanOrEqual": "8.13.0", "versionType": "semver"}, {"version": "8.12.1", "status": "affected", "lessThanOrEqual": "8.12.1", "versionType": "semver"}, {"version": "8.12.0", "status": "affected", "lessThanOrEqual": "8.12.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-92392.json", "name": "json"}, {"url": "https://curl.se/docs/CVE-2026-92392.html", "name": "www"}, {"url": "https://hackerone.com/reports/4030333", "name": "issue"}], "credits": [{"lang": "en", "value": "Luna with Claude", "type": "finder"}, {"lang": "en", "value": "Anthropic", "type": "finder"}, {"lang": "en", "value": "Stefan Eissing", "type": "remediation developer"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free"}]}], "references": [{"url": "https://hackerone.com/reports/4030333", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-15T03:56:56.051034Z", "id": "CVE-2026-92392", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T10:28:17.201Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"lessThanOrEqual": "8.22.0", "status": "affected", "version": "8.22.0", "versionType": "semver"}, {"lessThanOrEqual": "8.21.0", "status": "affected", "version": "8.21.0", "versionType": "semver"}, {"lessThanOrEqual": "8.20.0", "status": "affected", "version": "8.20.0", "versionType": "semver"}, {"lessThanOrEqual": "8.19.0", "status": "affected", "version": "8.19.0", "versionType": "semver"}, {"lessThanOrEqual": "8.18.0", "status": "affected", "version": "8.18.0", "versionType": "semver"}, {"lessThanOrEqual": "8.17.0", "status": "affected", "version": "8.17.0", "versionType": "semver"}, {"lessThanOrEqual": "8.16.0", "status": "affected", "version": "8.16.0", "versionType": "semver"}, {"lessThanOrEqual": "8.15.0", "status": "affected", "version": "8.15.0", "versionType": "semver"}, {"lessThanOrEqual": "8.14.1", "status": "affected", "version": "8.14.1", "versionType": "semver"}, {"lessThanOrEqual": "8.14.0", "status": "affected", "version": "8.14.0", "versionType": "semver"}, {"lessThanOrEqual": "8.13.0", "status": "affected", "version": "8.13.0", "versionType": "semver"}, {"lessThanOrEqual": "8.12.1", "status": "affected", "version": "8.12.1", "versionType": "semver"}, {"lessThanOrEqual": "8.12.0", "status": "affected", "version": "8.12.0", "versionType": "semver"}]}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}], "id": "CVE-2026-92392", "lastModified": "2026-10-15T11:18:03.600", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92392", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T03:56:56.051034Z", "version": "2.0.3"}}]}, "published": "2026-10-14T08:17:05.997", "references": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "url": "https://curl.se/docs/CVE-2026-92392.html"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "url": "https://curl.se/docs/CVE-2026-92392.json"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "url": "https://hackerone.com/reports/4030333"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://hackerone.com/reports/4030333"}], "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Luna with Claude (Anthropic) for reporting this issue.", "affected_release": [{"advisory": "RHSA-2026:80349", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "rust-main-1.99.0-1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-10-11T00:00:00Z"}, {"advisory": "RHSA-2026:82895", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "curl-main-8.23.0-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-10-14T00:00:00Z"}], "bugzilla": {"description": "curl: curl: HTTP/2 upload Use-After-Free", "id": "2548642", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548642"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-416", "details": ["During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.", "A flaw was found in curl. When curl uploads data over an HTTP/2 connection, it mishandles server stream reset frames, which can lead to the reuse of previously released memory. Under specific memory and timing conditions, a malicious server can exploit this flaw to execute arbitrary code on the client system or cause the application to crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-92392", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "igvm", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "s390utils", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "trustee", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "rpm-ostree", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "rust-toolset:rhel8/rust", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Not affected", "package_name": "jbcs-httpd24-curl", "product_name": "Red Hat JBoss Core Services"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rpm-ostree", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "foreman", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "openvox-agent", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "puppet-agent", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-14T12:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-92392\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92392"], "statement": "Red Hat has rated this flaw as having an Important severity because a malicious HTTP/2 server can remotely trigger memory corruption during data uploads, potentially leading to client application crashes or arbitrary code execution. While remote code execution has been demonstrated, exploitation requires strict prerequisites such as exact heap layout predictability and precise server-controlled timing, which limits broad automated exploitability. Earlier versions of Red Hat Enterprise Linux, including RHEL 8 and 9, are not vulnerable as they ship curl builds preceding the introduction of the flawed logic.", "threat_severity": "Important"}

{"created": "2026-10-14T15:30:03.401375+00:00", "updated": "2026-10-15T06:45:15.049213+00:00", "vendors": []}