CURL-CVE-2026-92392 HTTP/2 upload Use-After-Free

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

HTTP/2 upload Use-After-Free

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

CVE-2026-92392 HTTP/2 upload Use-After-Free

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

CVE-2026-92392

A use-after-free vulnerability exists in curl and libcurl (versions 8.12.0 through 8.22.0) when performing uploads over HTTP/2 . The flaw is triggered when a malicious server sends RST_STREAM frames with REFUSED_STREAM or HTTP_1_1_REQUIRED reasons while the client is uploading data, leading to th...

CVE-2026-92392: Use After Free

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

curl: Retry-independent time-condition HTTP/2 UAF

Relationship to the original report This is a supplemental trigger for HackerOne report 4030333, not a claim of an unrelated vulnerability. It reaches the same stale Curleasy condition through normal time-condition handling and shows that a fix limited to the original retry path is incomplete...