What happened

On 14 October 2026, the curl project disclosed CVE-2026-92392, a high-severity use-after-free vulnerability caused by incorrect handling of certain HTTP/2 stream-reset responses during uploads. The project reports that remote code execution is possible under a specific combination of build, memory layout, and timing conditions. [1]

The advisory identifies mainline versions 8.12.0 through 8.22.0 as affected, with the fix included in 8.23.0. It also lists fixed releases for selected maintained branches and links to the upstream patch. Both the libcurl library and the curl command-line tool can be affected. [1]

Why it matters for manufacturers

A product application, diagnostics agent, or file-transfer service may use libcurl. An inventory that checks only for the curl executable could miss these dependencies. Determining whether a product is affected also requires checking whether it enables HTTP/2 and uses the vulnerable upload functionality.

Patch history matters as well. A downstream package may retain its upstream version number while including a backported fix. Record the recipe configuration, how the application links to the library, the origin of any patches, and the application functionality that uses libcurl.

Regression tests should cover successful uploads and error handling, including server-side cancellation, retries, parallel transfers, and reconnection. These checks are particularly relevant to devices with intermittent connectivity.

What to review in your firmware

  • Identify every application that uses libcurl, including bundled copies, and confirm whether HTTP/2 uploads are enabled.
  • Compare the advisory with the exact package revision and applied patches on each supported branch.
  • Include the upstream fix reference, build record, and relevant transfer-test results with the proposed change.

The engineering takeaway

Determine whether the product uses the affected functionality, apply a compatible fix, and test both error conditions and normal operation. Keep the patch, build records, and test results together for review.

Primary source

  1. curl: CVE-2026-92392, HTTP/2 upload Use-After-Free14 October 2026. Covers affected branches, exploitation conditions, fixed releases, and the upstream patch.

Source reviewed on . The manufacturer guidance and engineering takeaway reflect Firmdura’s analysis.