HTTP/2 upload Use-After-Free

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

CVE-2026-92392

A use-after-free vulnerability exists in curl and libcurl (versions 8.12.0 through 8.22.0) when performing uploads over HTTP/2 . The flaw is triggered when a malicious server sends RST_STREAM frames with REFUSED_STREAM or HTTP_1_1_REQUIRED reasons while the client is uploading data, leading to th...

CVE-2026-92392 HTTP/2 upload Use-After-Free

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

EUVD-2026-100915

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

CVE-2026-92392

During an upload, curl mishandles HTTP/2 "RSTSTREAM" received from the server with reason "HTTP11REQUIRED" or "REFUSEDSTREAM" leading to a use after free of a "struct Curleasy" object...

CVE-2026-92392 HTTP/2 upload Use-After-Free

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

CVE-2026-92392

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

CVE-2026-92392

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

[SECURITY] [DSA 6558-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6558-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 14, 2026 https://www.debian.org/security/faq -...

UBUNTU-CVE-2026-92392

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

CVE-2026-92392

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

CVE-2026-92392: Use After Free

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

Linux Distros Unpatched Vulnerability : CVE-2026-92392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct...

Debian dsa-6558 : curl - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6558 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6558-1 [email protected] https://www.debian.org/securit...

rapidresetclient

Rapid Reset Client Rapid Reset Client è uno strumento per testare le mitigazioni e l'esposizione a CVE-2023-44487 vettore di attacco DDoS Rapid Reset. Implementa un client HTTP/2 minimale che apre un singolo socket TCP, negozia TLS, ignora il certificato e scambia frame SETTINGS. Il client invia...

AlmaLinux 9.2 [TuxCare] Security Update: libnghttp2 / libnghttp2-devel / nghttp2 Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778129164)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778129164 advisory. - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

Rocky Linux 9.6 [TuxCare] Security Update: libnghttp2 / libnghttp2-devel / nghttp2 (ALMALINUX9.6:CLSA-2026:1778148827)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778148827 advisory. - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures...

AlmaLinux 9.6 [TuxCare] Security Update: libnghttp2 / libnghttp2-devel / nghttp2 (ALMALINUX9.6:CLSA-2026:1778148827)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778148827 advisory. - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nghttp2 (UTSA-2023-002139)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002139 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. Envoys HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM...

curl: CVE-2026-92392: HTTP/2 upload Use-After-Free

Summary: During a file upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object. The control flow is a bit complicated, so I've produced an ASCII tree of the control flow to highlight the...