CVE-2026-92392

curl

15/100

predicted likelihood

CVSS8.1

EPSS0.2%

KEVNone

During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.

EPSS 0.002 (probability of exploitation) · CVSS base 8.1 · 1 public PoC/exploit reference(s) available

Public PoC / Exploit1

Defensive review only — these references demonstrate exploitability.

githubashu7ank/CVE-2026-92392 (★0)

References3

NVD detail Referencecurl.se Referencecurl.se Referencehackerone.com

Mentions 2

securityonline.info
cURL Releases Version 8.23.0 to Fix Critical Flaw
research.jfrog.com
CVE-2026-92392: curl HTTP/2 upload RCE