-J no-clobber guarantee bypassed with 103 early hints
=====================================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-92390.html)

VULNERABILITY
-------------

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its
documented anti-clobbering protection if an intermediate 103 Early Hints
response precedes the final HTTP response, or if an `ETag` header is processed
before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)
server to overwrite an existing local file specified in the
`Content-Disposition` header despite the presence of the `-J` non-overwrite
constraint.

INFO
----

This problem is similar, but not identical, to the previous vulnerability
[CVE-2020-8177](https://curl.se/docs/CVE-2020-8177.html)

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-92390 to this issue.

CWE-73: External Control of File Name or Path

Severity: Low

This bug is not considered a *C mistake* (likely to have been avoided had we
not been using C).

AFFECTED VERSIONS
-----------------

- Affected versions: curl 7.20.0 to and including 8.22.0
- Not affected versions: curl < 7.20.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/80675818e0417b

curl is used by many applications, but not always advertised as such!

This flaw only affects the curl command line tool, not libcurl.

SOLUTION
--------

- Fixed-in: https://github.com/curl/curl/commit/c24a69d8cd368de4e25e35

RECOMMENDATIONS
---------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Avoid using the `-J` option

TIMELINE
--------

This issue was reported to the curl project on September 12, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Joshua Rogers (Aisle Research)
- Patched-by: Joshua Rogers (Aisle Research)

Thanks a lot!