CVE-2026-92390
Awaiting Analysis Awaiting Analysis - Queue

curl Remote File Overwrite via Early Hints or ETag Processing

Publication date: 2026-10-20

Last updated on: 2026-10-30

Assigner: curl

Description
When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-30
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-08
NVD
CVE-2026-92390

Affected Vendors & Products

Showing 135 associated CPEs
Vendor Product Version / Range
curl curl 8.22.0
curl curl 8.21.0
curl curl 8.20.0
curl curl 8.19.0
curl curl 8.18.0
curl curl 8.17.0
curl curl 8.16.0
curl curl 8.15.0
curl curl 8.14.1
curl curl 8.14.0
curl curl 8.13.0
curl curl 8.12.1
curl curl 8.12.0
curl curl 8.11.1
curl curl 8.11.0
curl curl 8.10.1
curl curl 8.10.0
curl curl 8.9.1
curl curl 8.9.0
curl curl 8.8.0
curl curl 8.7.1
curl curl 8.7.0
curl curl 8.6.0
curl curl 8.5.0
curl curl 8.4.0
curl curl 8.3.0
curl curl 8.2.1
curl curl 8.2.0
curl curl 8.1.2
curl curl 8.1.1
curl curl 8.1.0
curl curl 8.0.1
curl curl 8.0.0
curl curl 7.88.1
curl curl 7.88.0
curl curl 7.87.0
curl curl 7.86.0
curl curl 7.85.0
curl curl 7.84.0
curl curl 7.83.1
curl curl 7.83.0
curl curl 7.82.0
curl curl 7.81.0
curl curl 7.80.0
curl curl 7.79.1
curl curl 7.79.0
curl curl 7.78.0
curl curl 7.77.0
curl curl 7.76.1
curl curl 7.76.0
curl curl 7.75.0
curl curl 7.74.0
curl curl 7.73.0
curl curl 7.72.0
curl curl 7.71.1
curl curl 7.71.0
curl curl 7.70.0
curl curl 7.69.1
curl curl 7.69.0
curl curl 7.68.0
curl curl 7.67.0
curl curl 7.66.0
curl curl 7.65.3
curl curl 7.65.2
curl curl 7.65.1
curl curl 7.65.0
curl curl 7.64.1
curl curl 7.64.0
curl curl 7.63.0
curl curl 7.62.0
curl curl 7.61.1
curl curl 7.61.0
curl curl 7.60.0
curl curl 7.59.0
curl curl 7.58.0
curl curl 7.57.0
curl curl 7.56.1
curl curl 7.56.0
curl curl 7.55.1
curl curl 7.55.0
curl curl 7.54.1
curl curl 7.54.0
curl curl 7.53.1
curl curl 7.53.0
curl curl 7.52.1
curl curl 7.52.0
curl curl 7.51.0
curl curl 7.50.3
curl curl 7.50.2
curl curl 7.50.1
curl curl 7.50.0
curl curl 7.49.1
curl curl 7.49.0
curl curl 7.48.0
curl curl 7.47.1
curl curl 7.47.0
curl curl 7.46.0
curl curl 7.45.0
curl curl 7.44.0
curl curl 7.43.0
curl curl 7.42.1
curl curl 7.42.0
curl curl 7.41.0
curl curl 7.40.0
curl curl 7.39.0
curl curl 7.38.0
curl curl 7.37.1
curl curl 7.37.0
curl curl 7.36.0
curl curl 7.35.0
curl curl 7.34.0
curl curl 7.33.0
curl curl 7.32.0
curl curl 7.31.0
curl curl 7.30.0
curl curl 7.29.0
curl curl 7.28.1
curl curl 7.28.0
curl curl 7.27.0
curl curl 7.26.0
curl curl 7.25.0
curl curl 7.24.0
curl curl 7.23.1
curl curl 7.23.0
curl curl 7.22.0
curl curl 7.21.7
curl curl 7.21.6
curl curl 7.21.5
curl curl 7.21.4
curl curl 7.21.3
curl curl 7.21.2
curl curl 7.21.1
curl curl 7.21.0
curl curl 7.20.1
curl curl 7.20.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in curl occurs when using the `--remote-header-name` (`-J`) option. Normally, curl prevents overwriting existing local files specified in the `Content-Disposition` header. However, if an intermediate 103 Early Hints response precedes the final HTTP response or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`, curl fails to preserve this protection. This allows an HTTP(S) server to overwrite an existing local file despite the non-overwrite constraint.

Detection Guidance

This vulnerability affects curl versions handling HTTP(S) responses with specific headers. To detect it, check your curl version with `curl --version` and look for affected releases. Monitor network traffic for 103 Early Hints responses or ETag headers preceding Content-Disposition in responses using tools like Wireshark or tcpdump.

Impact Analysis

This vulnerability could allow an attacker to overwrite important files on your system by tricking you into downloading a malicious file. If you use curl with `-J` to save files from untrusted sources, an attacker could replace existing files like configuration files, scripts, or sensitive data with malicious versions.

Mitigation Strategies

Update curl to the latest patched version to address the anti-clobbering protection failure when using --remote-header-name or --etag-save options.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92390. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...