curl 8.23.0 was released on 14 October 2026 with 24 security fixes. The standout is CVE-2026-92392, HTTP/2 upload Use-After-Free, rated HIGH by the curl project (CWE-416). During an HTTP/2 upload, mishandling of a server RST_STREAM (HTTP_1_1_REQUIRED or REFUSED_STREAM) can leave a dangling pointer to a Curl_easy handle; when the application frees that handle and later cleans up the multi handle, libcurl can download attacker-controlled data into the freed memory and then call a corrupted function pointer — remote code execution.

Affected: curl 8.12.0 through 8.22.0; not affected: before 8.12.0, 8.23.0 and later, plus the older-branch fixes 8.14.3, 8.16.2 and 8.20.2 listed in the advisory.

Daniel Stenberg says successful RCE needs many concurrent conditions (valid server certificate for an upload of roughly the right size, known architecture/libc/heap layout, nghttp2 and OpenSSL/TLS 1.3 allocation behaviour, ~23-byte payload window), so wild exploitation is judged extremely difficult and a crash is the likelier outcome — hence HIGH not CRITICAL.

The bug was found and reported by Luna Tong at Anthropic using Anthropic's OSS Scanner on 15 September; the release was brought forward by two weeks.

Primary: curl CVE-2026-92392 advisory and Daniel Stenberg's UAF write-up; release notes for 8.23.0.

UPDATE 15 October: the reporter's HackerOne write-up (report 4030333), with the malicious server script and a Docker container described as reproducing the code execution, became public alongside the advisory on 14 October, so a proof of concept is available; no source reports attacks using it. curl's machine-readable advisory lists the fixed versions as 8.14.3, 8.16.2, 8.20.2 and 8.23.0. Debian 13 (trixie) is fixed in 8.14.1-2+deb13u7 (DSA-6558-1); Debian 12 (bookworm) does not carry the vulnerable code.

The Hacker News says the attack needs the client to upload a file of roughly 135 KB over HTTP/2 to an attacker-controlled server whose certificate passes the client's checks, and that libcurl negotiates HTTP/2 by default for https:// URLs when built with HTTP/2 support. curl's interim advice is not to use HTTP/2. Wire: The Hacker News.