CVE-2026-92391

Awaiting Analysis Awaiting Analysis - Queue

Stack Overflow in libcurl via Malformed MIME Structure

Publication date: 2026-10-20

Last updated on: 2026-10-30

Assigner: curl

Description

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-92391

Affected Vendors & Products

Vendor	Product	Version / Range
curl	curl	8.22.0
curl	curl	8.21.0
curl	curl	8.20.0
curl	curl	8.19.0
curl	curl	8.18.0
curl	curl	8.17.0
curl	curl	8.16.0
curl	curl	8.15.0
curl	curl	8.14.1
curl	curl	8.14.0
curl	curl	8.13.0
curl	curl	8.12.1
curl	curl	8.12.0
curl	curl	8.11.1
curl	curl	8.11.0
curl	curl	8.10.1
curl	curl	8.10.0
curl	curl	8.9.1
curl	curl	8.9.0
curl	curl	8.8.0
curl	curl	8.7.1
curl	curl	8.7.0
curl	curl	8.6.0
curl	curl	8.5.0
curl	curl	8.4.0
curl	curl	8.3.0
curl	curl	8.2.1
curl	curl	8.2.0
curl	curl	8.1.2
curl	curl	8.1.1
curl	curl	8.1.0
curl	curl	8.0.1
curl	curl	8.0.0
curl	curl	7.88.1
curl	curl	7.88.0
curl	curl	7.87.0
curl	curl	7.86.0
curl	curl	7.85.0
curl	curl	7.84.0
curl	curl	7.83.1
curl	curl	7.83.0
curl	curl	7.82.0
curl	curl	7.81.0
curl	curl	7.80.0
curl	curl	7.79.1
curl	curl	7.79.0
curl	curl	7.78.0
curl	curl	7.77.0
curl	curl	7.76.1
curl	curl	7.76.0
curl	curl	7.75.0
curl	curl	7.74.0
curl	curl	7.73.0
curl	curl	7.72.0
curl	curl	7.71.1
curl	curl	7.71.0
curl	curl	7.70.0
curl	curl	7.69.1
curl	curl	7.69.0
curl	curl	7.68.0
curl	curl	7.67.0
curl	curl	7.66.0
curl	curl	7.65.3
curl	curl	7.65.2
curl	curl	7.65.1
curl	curl	7.65.0
curl	curl	7.64.1
curl	curl	7.64.0
curl	curl	7.63.0
curl	curl	7.62.0
curl	curl	7.61.1
curl	curl	7.61.0
curl	curl	7.60.0
curl	curl	7.59.0
curl	curl	7.58.0
curl	curl	7.57.0
curl	curl	7.56.1
curl	curl	7.56.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability involves a deeply nested multipart MIME structure created via the public API that triggers a stack overflow in libcurl during cleanup. The issue occurs in the curl_mime_free function where excessive recursion depth leads to unbounded stack frame allocation while traversing the structure, causing the host process to crash.

Detection Guidance

This vulnerability causes a stack overflow in libcurl during cleanup of deeply nested multipart MIME structures. Detection requires checking for crashes in applications using libcurl when processing such MIME structures. Monitor logs for segmentation faults or stack overflow errors in curl-related processes.

Impact Analysis

This vulnerability can cause applications using libcurl to crash unexpectedly when processing or cleaning up deeply nested MIME structures. This may lead to denial of service, data loss, or application instability if exploited maliciously or triggered by unexpected input.

Compliance Impact

The vulnerability causes a stack overflow in libcurl during cleanup, leading to process crashes. This could disrupt data processing operations, potentially violating availability requirements in GDPR and HIPAA.

Mitigation Strategies

Update libcurl to the latest patched version to prevent stack overflow from nested MIME structures. Avoid processing untrusted multipart MIME data until patched.

Hi! I’m here to help you understand CVE-2026-92391. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...