curl moves up its next release to fix 22 pending vulnerabilities
Daniel Stenberg says curl 8.23.0 ships on 14 October with 22 CVE fixes, including only the project's second HIGH-severity bug since 2021.
curl maintainer Daniel Stenberg announced on 7 October that curl 8.23.0 will ship on 14 October with fixes for 22 pending security vulnerabilities. One is rated HIGH severity (CVE-2026-92392) and the other 21 are lower. curl only uses four severity levels and does not score bugs with CVSS, and Stenberg notes this is just the second HIGH-rated CVE the project has issued since 2021.
The release was moved up by several weeks after a report came in about the HIGH-severity flaw. Technical details stay under embargo until the European morning of 14 October, when the fixed release goes out; distribution maintainers and paying support customers have already been notified. Stenberg says a follow-up post will explain the bug’s mechanics and exploitability once the embargo lifts.
Why it matters: curl and libcurl sit underneath an enormous share of what the web runs on — PHP’s cURL extension, countless CLI scripts, container base images, and HTTP clients in other languages. A HIGH-severity curl bug is worth a calendar entry now: plan to check which of your builds vendor curl and be ready to update on the 14th, rather than finding out a week late.
The caveat: no technical detail is public yet, so there’s nothing to patch today — this is advance notice of a date, not an advisory to act on.