curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution

A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned that into code execution on the uploading machine. The curl project fixed it on October 14 in curl 8.23.0. Taking over a client needs exact...

USN-8927-1: curl vulnerabilities

It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this issue to obtain sensitive information. CVE-2026-107928 Maksim discovered that curl did not correctly include the interface binding in connection...

curl: curl: HTTP/2 upload Use-After-Free

A flaw was found in curl. When curl uploads data over an HTTP/2 connection, it mishandles server stream reset frames, which can lead to the reuse of previously released memory. Under specific memory and timing conditions, a malicious server can exploit this flaw to execute arbitrary code on the...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: curl: curl-8.23.0-0.1.hum1 aarch64, s390x, x8664 libcurl-8.23.0-0.1.hum1 aarch64, s390x, x8664 libcurl-devel-8.23.0-0.1.hum1 aarch64, s390x, x8664 libcurl-minimal-8.23.0-0.1.hum1 aarch64, s390x,...

ROOT-OS-DEBIAN-13-CVE-2026-8927 CVE-2026-8927 in curl - Patched by Root

Root has patched CVE-2026-8927 in the curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-8926 CVE-2026-8926 in curl - Patched by Root

Root has patched CVE-2026-8926 in the curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-9545 CVE-2026-9545 in curl - Patched by Root

Root has patched CVE-2026-9545 in the curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-10536 CVE-2026-10536 in curl - Patched by Root

Root has patched CVE-2026-10536 in the curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-8924 CVE-2026-8924 in curl - Patched by Root

Root has patched CVE-2026-8924 in the curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-14017 CVE-2025-14017 in curl - Patched by Root

Root has patched CVE-2025-14017 in the curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-82209 CVE-2026-82209 in curl - Patched by Root

Root has patched CVE-2026-82209 in the curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-8286 CVE-2026-8286 in curl - Patched by Root

Root has patched CVE-2026-8286 in the curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-80230 CVE-2026-80230 in curl - Patched by Root

Root has patched CVE-2026-80230 in the curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-9547 CVE-2026-9547 in curl - Patched by Root

Root has patched CVE-2026-9547 in the curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-11856 CVE-2026-11856 in curl - Patched by Root

Root has patched CVE-2026-11856 in the curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-19931 CVE-2026-19931 in curl - Patched by Root

Root has patched CVE-2026-19931 in the curl package for Root:Debian:13. Multiple fixed versions available...

DEBIAN-CVE-2026-92392

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

CVE-2026-92392

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

CURL-CVE-2026-87862 HSTS cache import drops longer-lived child

Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS...

CURL-CVE-2026-92392 HTTP/2 upload Use-After-Free

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...