curl 8.23.0 fixes high-severity HTTP/2 flaw, found with help from Claude

On October 14, the curl project released version 8.23.0 of its transfer tool and its libcurl library, which are found in countless systems, applications and connected devices. Among other things, it fixes CVE-2026-92392: a "use-after-free" flaw (reuse of a memory area that has already been freed) in the way HTTP/2 sends data. The project rates it high severity. Versions 8.12.0 through 8.22.0 are affected, including the command-line tool.

A booby-trapped server as the starting point

According to the project's advisory, the problem occurs when a server interrupts an upload in progress with an RST_STREAM message carrying the REFUSED_STREAM or HTTP_1_1_REQUIRED reason code. curl then frees an internal structure that is still in use. The victim must therefore send data to a server controlled by the attacker and equipped with a valid certificate.

According to the advisory, it has been demonstrated that this bug can be turned into remote code execution, but only if a long list of conditions is met: exact version and architecture known, precise memory layout, and predictable behavior from the nghttp2 and OpenSSL libraries. curl's founder, Daniel Stenberg, adds on his blog that an upload of about 135 KB is also required, along with a payload of barely twenty bytes. In his view, the most likely outcome is a crash, and a successful attack is unlikely. Neither the advisory nor the blog mentions any exploitation.

A flaw found with Anthropic's AI

The advisory credits the discovery to "Luna with Claude, Anthropic" and dates the report to September 15. According to Daniel Stenberg, Luna Tong of Anthropic found it with Anthropic's new tool called "OSS Scanner," which presumably relies on its AI models. The fix was written by Stefan Eissing. To ship the fix quickly, the team shortened this release cycle by two weeks, from eight to six weeks. For a few years now, it has also been replacing internal pointers with more robust transfer identifiers. Daniel Stenberg acknowledges that a memory-safe language would probably have prevented this bug, but rules out rewriting curl. Another change in this release: support for the SMB protocol is removed.

What to do

• Update to curl 8.23.0. For the maintained branches, versions 8.20.2, 8.16.2 and 8.14.3 are not affected.
• Take inventory of the software, container images and firmware that embed libcurl: they will depend on their vendor's update.
• If the update has to wait, the only workaround the project lists is to not use HTTP/2.
• If you use curl with SMB, plan a replacement solution before updating.