Bug 2548642 (CVE-2026-92392)

Summary:	CVE-2026-92392 curl: curl: HTTP/2 upload Use-After-Free
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, anthomas, aos-team-art-private, asdas, crizzo, csutherl, dpaolell, ehelms, ggainey, jcantril, jclere, jdelft, jpasqual, jupierce, juwatts, lgarciaa, mbiarnes, mdellweg, mhulan, nmoumoul, osousa, pcreech, pjindal, plodge, ppalepu, ppostler, prdhamdh, rchan, rekumar, rhel-process-autobot, rojacob, security-response-team, sghai, sidsharm, smallamp, suppawar, szappis, tmalecek, vchlup, vlaad, vvoronko, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in curl. When curl uploads data over an HTTP/2 connection, it mishandles server stream reset frames, which can lead to the reuse of previously released memory. Under specific memory and timing conditions, a malicious server can exploit this flaw to execute arbitrary code on the client system or cause the application to crash, resulting in a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-10-14

Description OSIDB Bzimport 2026-10-09 15:06:46 UTC

During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server
(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after
free of a `struct Curl_easy` object.

INFO
----

This Use-After-Free flaw has been proven to be possible to convert into a
Remote Code Execution if a set of specific criteria are met by the malicious
server:

- the exact curl version object and structure layout used for the transfer is
  known and used to derive attack offsets;
- exact architecture details of the running curl needs to be known
- a known and compatible libc allocator build and heap layout
- nghttp2 and OpenSSL/TLS 1.3 behavior, including allocation effects around
  session tickets
- a pinned CA bundle and other input-dependent allocation geometry
- two parallel transfers and their scheduling/timing need to remain
- correctly calibrated libc leak and symbol offsets; and
- the exploit's current short-command constraint (approximately 23 bytes).

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-92392 to this issue.

CWE-416: Use After Free

Severity: High

This bug is considered a *C mistake* (likely to have been avoided had we not
been using C).

AFFECTED VERSIONS
-----------------

- Affected versions: curl 8.12.0 to and including 8.22.0
- Not affected versions: curl < 7.12.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/cd9107e0128191b7b5396b

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/

RECOMMENDATIONS
---------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Do not use HTTP/2

TIMELINE
--------

This issue was reported to the curl project on September 15, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Luna with Claude, Anthropic
- Patched-by: Stefan Eissing

Thanks a lot!