Bug 2550708 (CVE-2026-92391)

Summary:	CVE-2026-92391 curl: curl: curl_mime_free stack overflow by recursion
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	anthomas, csutherl, ehelms, ggainey, jclere, jpasqual, juwatts, mdellweg, mhulan, nmoumoul, osousa, pcreech, pjindal, plodge, rchan, rekumar, rhel-process-autobot, security-response-team, smallamp, szappis, tmalecek, vchlup, vvoronko, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in curl. An attacker could supply deeply nested Multipurpose Internet Mail Extensions (MIME) structures to an application utilizing the libcurl library. During memory cleanup in the curl_mime_free function, excessive recursive calls exhaust available stack memory, leading to an application crash and a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-10-14

Description OSIDB Bzimport 2026-10-13 17:27:18 UTC

curl_mime_free stack overflow by recursion
==========================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-92391.html)

VULNERABILITY
-------------

A deeply nested multipart MIME structure constructed via the public API causes
a stack overflow in libcurl during normal cleanup operations. An excessive
recursion depth within `curl_mime_free` leads to unbounded stack frame
allocation during structure traversal, ultimately crashing the host process.

INFO
----

Normal mime setups typically contain a few parts up to extreme cases of
hundreds. This flaw needs thousands to trigger, the exact amount depending on
your system and configuration.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-92391 to this issue.

CWE-674: Uncontrolled Recursion

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 7.56.0 to and including 8.22.0
- Not affected versions: curl < 7.56.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/ce0881edee3c78609eae49

libcurl is used by many applications, but not always advertised as such!

This flaw does not affect the curl command line tool.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/d7546809d5bd548b69ec49fca2

RECOMMENDATIONS
---------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Avoid the MIME API

TIMELINE
--------

This issue was reported to the curl project on September 12, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Joshua Rogers (Aisle Research)
- Patched-by: Daniel Stenberg

Thanks a lot!