# curl 8.23.0 fixes HTTP/2 upload flaw demonstrated to execute client code

_Published Wednesday, October 14, 2026 at 9:05 AM EDT · Security, Infrastructure · Latest · Tier 1 — Major_

![curl 8.23.0 fixes HTTP/2 upload flaw demonstrated to execute client code — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj4S_5rQ2kApGYmSMOh6PFsgD3yRugV3_nzSexwBhEe3BoSTQeBfSu2-3JSO4wDCnU2LmVMWtgA6AcBEcf2wOpsL2v22woZ5fel0XaSonlbgDWSXMuV3iu5ewohp9kqgf4OwmCvtnRyyYjFEP6Z3RRLT5sX8g7-xI1robnLmWtqFp6SvrGvpBeXI_D4ICo/s1700-nu-rw-lo-l85-e365/curl.jpg)

The curl project released version 8.23.0 on October 14 to fix an HTTP/2 upload flaw that a researcher demonstrated could execute code on the uploading machine. CVE-2026-92392 affects curl and libcurl versions 8.12.0 through 8.22.0. The project shortened its release cycle by two weeks to deliver the fix.

A malicious receiving server can manipulate an upload so curl later uses a pointer to freed memory. Exploitation requires an HTTP/2 upload and a server certificate that passes the client's checks. Code execution also requires exact knowledge of the target's build and memory layout; curl expects attempted attacks more commonly to cause a crash. Users can upgrade or apply the fix, with avoiding HTTP/2 offered as an interim mitigation.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/curl-patches-http2-upload-flaw-after.html)

---
Canonical: https://techandbusiness.org/newswire/HymiTadi4hUIjjPVmQhWCS
Published: 2026-10-14T13:05:32.355Z
Story chronology: 2026-10-14T12:13:36.000Z
Retrieved: 2026-10-14T15:53:12.494Z
Publisher: Tech & Business (techandbusiness.org)