CVE-2026-92392
Received
Received - Intake
curl HTTP/2 RST_STREAM Use After Free Vulnerability
Vulnerability report for CVE-2026-92392, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-14
Last updated on: 2026-10-14
Assigner: curl
Description
Description
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server
(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after
free of a `struct Curl_easy` object.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| curl | curl | 8.22.0 |
| curl | curl | 8.21.0 |
| curl | curl | 8.20.0 |
| curl | curl | 8.19.0 |
| curl | curl | 8.18.0 |
| curl | curl | 8.17.0 |
| curl | curl | 8.16.0 |
| curl | curl | 8.15.0 |
| curl | curl | 8.14.1 |
| curl | curl | 8.14.0 |
| curl | curl | 8.13.0 |
| curl | curl | 8.12.1 |
| curl | curl | 8.12.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
