CVE-2026-92390

A flaw was found in curl. When the command-line tool is executed with the remote header name option to prevent overwriting existing files, a malicious server can bypass this protection by returning an intermediate HTTP 103 Early Hints response or through specific header ordering. This flaw allows...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the -J option in the command-line tool when handling HTTP 103 Early Hints responses or specific header ordering. An attacker can overwrite existing local files by controlling the remote server's...