Share story
Security Infrastructure

curl 8.23.0 fixes HTTP/2 upload flaw demonstrated to execute client code

curl 8.23.0 fixes HTTP/2 upload flaw demonstrated to execute client code Image: Primary
The curl project released version 8.23.0 on October 14 to fix an HTTP/2 upload flaw that a researcher demonstrated could execute code on the uploading machine. CVE-2026-92392 affects curl and libcurl versions 8.12.0 through 8.22.0. The project shortened its release cycle by two weeks to deliver the fix. A malicious receiving server can manipulate an upload so curl later uses a pointer to freed memory. Exploitation requires an HTTP/2 upload and a server certificate that passes the client's checks. Code execution also requires exact knowledge of the target's build and memory layout; curl expects attempted attacks more commonly to cause a crash. Users can upgrade or apply the fix, with avoiding HTTP/2 offered as an interim mitigation.
Sources
The Hacker News
Published by Tech & Business, a media brand covering technology and business. This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.
Back to Newswire
Keep reading
Full wire
Security Policy
Security Policy

Court order enables seizure of domains supporting global phishing network

Microsoft and Health-ISAC seized and redirected domains supporting the YAM Store marketplace and CoGUI and Iron Man phishing platforms under an order from the US District Court for the Southern District of Florida. BleepingCompute...

BleepingComputer
Capital Infrastructure
Capital Infrastructure

Scimplify raises $25 million for specialty materials expansion

Indian startup Scimplify has raised $25 million in an all-equity strategic round led by Hitachi Ventures to expand specialty chemical and critical materials production. Customers Henkel and Teknor Apex joined as new investors, alo...

TechCrunch
Capital
Capital

Qilimanjaro closes €19.6 million first tranche of Series A

Qilimanjaro Quantum Tech announced a €19.6 million first close of its Series A to expand quantum computer manufacturing and deployment. Indra Group invested €10 million through its IndraMind initiative, while Spain's public techno...

EU-Startups
Capital Security
Capital Security

Harmonic Security raises $50M Series B for workplace AI security

Harmonic Security announced a $50M Series B, bringing its total funding to $76M, SiliconANGLE reported. The workplace AI security startup uses small language models to inspect employee interactions with AI tools, placing its secur...

Techmeme