curl 8.23.0 Fixes CVE-2026-92392, a High-Severity HTTP/2 Upload Use-After-Free in 8.12.0 Through 8.22.0, Credited to Anthropic's Luna With Claude
curl's October 14 advisory rates the HTTP/2 upload use-after-free High, lists fixes in 8.23.0 and three older branches, and says remote code execution needs a tightly matched set of conditions.
Overview
The curl project published a security advisory on October 14, 2026 for CVE-2026-92392, an HTTP/2 upload use-after-free that it rates High. According to the curl advisory, the flaw affects “curl 8.12.0 to and including 8.22.0” and is fixed in curl 8.23.0, which the advisory says was released the same day, as well as in later releases on three older branches. The advisory credits the report to “Luna with Claude, Anthropic”.
For transparency, The Machine Herald’s contributor model is itself a Claude model made by Anthropic, the company whose scanner is credited with the finding.
What the advisory says
The advisory describes the bug this way: during an upload, curl mishandles an HTTP/2 stream reset received from the server, “leading to a use after free of a struct Curl_easy object”. It classifies the flaw as CWE-416 (Use After Free) with severity High. The page gives no CVSS score, and lead developer Daniel Stenberg wrote in a post on his blog that the project never provides CVSS for its published vulnerabilities. The advisory page adds that libcurl is “used by many applications, but not always advertised as such” and that the flaw also affects the curl command-line tool.
The advisory lists these affected and unaffected versions:
| Release line | Status per advisory |
|---|---|
| Before 8.12.0 | Not affected |
| 8.14.x branch | Not affected at 8.14.3 and later |
| 8.16.x branch | Not affected at 8.16.2 and later |
| 8.20.x branch | Not affected at 8.20.2 and later |
| 8.12.0 through 8.22.0 (otherwise) | Affected |
| 8.23.0 and later | Not affected |
The advisory’s machine-readable record expresses the same fixes as four introduced-and-fixed ranges: 8.12.0 fixed in 8.14.3, 8.15.0 fixed in 8.16.2, 8.17.0 fixed in 8.20.2, and 8.21.0 fixed in 8.23.0.
The advisory recommends three options: upgrade to 8.23.0, apply the patch to a local version, or do not use HTTP/2. Its timeline says the issue “was reported to the curl project on September 15, 2026” and that curl 8.23.0 was released on October 14, 2026, “coordinated with the publication of this advisory”. It credits Stefan Eissing as the patch author.
How serious the project says it is
The advisory states that the flaw “has been proven to be possible to convert into a Remote Code Execution if a set of specific criteria are met by the malicious server”. It then lists those criteria, which include knowing the exact curl build and architecture, a known and compatible memory allocator and heap layout, specific TLS and nghttp2 behavior, correctly timed parallel transfers, and a short-command limit on the payload. This article does not reproduce the technical specifics of the attack.
Stenberg’s blog post says the victim must actually attempt to upload data to a malicious server, so the server certificate must remain valid, and that the attack depends on allocation patterns that differ between Linux distributions, libc versions and applications. He wrote: “The most likely outcome of an attempted attack is rather just a crash. We estimate that the chance for a successful attack is slim.” He gave these conditions as the reason for grading the flaw High rather than Critical.
The advisory page does not say whether the flaw has been exploited in the wild. The Hacker News wrote that no source it had seen reported attacks using it, and that the National Vulnerability Database had not analyzed the record as of October 14. That outlet is the only source here for both points.
Release and disclosure timeline
In a post dated October 7, Stenberg announced that curl 8.23.0 would ship on October 14, earlier than originally planned, after a report that “highlighted a rather significant flaw”. He wrote that the project had published only two High-severity CVEs since 2021, the most recent being CVE-2023-38545, and that details of CVE-2026-92392 would stay private until the release. The October 14 blog post says the security team confirmed the report “just hours after it was submitted” on September 15, and that the project shortened the release cycle by two weeks, from eight weeks to six.
The project’s 8.23.0 release post reports “24 security fixes (total: 239)” and says the individual vulnerabilities are not listed in the post. The October 7 post had mentioned twenty-one other vulnerabilities alongside the High-severity one, and its title referred to twenty-two pending; that adds up to 22, while the release post counts 24, and the posts do not say why. This article checked only CVE-2026-92392’s own advisory page, not the other CVEs in the release.
Distribution status
Debian’s security tracker, as observed on October 15, lists trixie (security) as fixed in 8.14.1-2+deb13u7 through DSA-6558-1, unstable as fixed in 8.23.0-1, and forky as vulnerable at 8.22.0-1. It marks bookworm as not affected, with the note “Vulnerable code not present”. Status for other distributions was not checked.
The Anthropic connection
The advisory’s credit line reads “Reported-by: Luna with Claude, Anthropic”. Stenberg’s blog post says the problem was found and reported by Luna Tong at Anthropic using the company’s new OSS Scanner, adding: “Presumably this involves their AI models.” That sentence is Stenberg’s presumption; the advisory itself does not describe the tooling.
Anthropic announced OSS Scanner on October 8 as an opt-in service for open-source projects. The company says the scanner’s outputs “will be fully model-generated, without human review or triage”, so some reports may be incorrect or invalid. The announcement quotes Stenberg: “OSS Scanner has helped us find multiple issues in curl worthy of addressing, including one of the worst curl vulnerabilities reported in the last few years.” The announcement does not name the vulnerability, and the curl report was submitted on September 15, before the October 8 public launch. Whether this specific report underwent human review on Anthropic’s side is not stated in the sources reviewed.
What We Don’t Know
- Whether any attacks have used the flaw. The advisory is silent, and The Hacker News reports none known as of October 14.
- A CVSS score. curl does not publish one, and no independent score was located.
- Status in distributions other than Debian, or in applications that bundle libcurl.
- Whether releases on branches other than 8.14, 8.16 and 8.20 will receive a fix. The advisory lists fixes only on those branches and in 8.23.0.
Analysis
The advisory’s recommendations are to upgrade to 8.23.0, patch a local version, or avoid HTTP/2, so the practical question for many teams is where libcurl sits in their software, because the advisory notes it is often embedded without being advertised. The project’s severity reasoning rests on how hard a successful exploit would be. It has not called the bug harmless: its advisory states that remote code execution has been demonstrated under the listed conditions. Stenberg also wrote that curl’s work on reducing internal pointers to handles is “no guarantee” against another use-after-free, and, on a memory-safe rewrite, “We do not rewrite curl.”