Use After Free Vulnerability in Curl Affects Multiple Versions
CVE-2026-92392

Currently unrated

Key Information:

Vendor: Curl
Status: Curl
Vendor: CVE Published:; 14 October 2026

What is CVE-2026-92392?

A vulnerability exists in the curl software where improper handling of HTTP/2 RST_STREAM responses from the server can lead to a use after free condition in the struct Curl_easy object. This occurs during an upload process when the server sends back specific reasons for RST_STREAM, such as HTTP_1_1_REQUIRED or REFUSED_STREAM. This flaw could potentially allow attackers to exploit the application, leading to unexpected behavior or crashes.