curl 8.23.0 fixes a High-severity use-after-free in HTTP/2 uploads

curl 8.23.0, released today, fixes CVE-2026-92392: a use-after-free in how curl handles HTTP/2 uploads. When a server resets the stream mid-upload with RST_STREAM, curl is left holding a dangling pointer to the Curl_easy struct, which later gets freed and then dereferenced during cleanup. curl rates it High, its first High-severity bug since the SOCKS5 heap overflow in 2023.

The bug affects curl and libcurl 8.12.0 through 8.22.0. Fixes are also backported to 8.20.2, 8.16.2 and 8.14.3 for anyone pinned to an older branch. curl’s own advisory is candid that turning this into remote code execution needs a lot to line up at once: a known object layout, architecture, heap state and precise timing, with only around 23 bytes of attacker-controlled space to work with. Crashing curl is far more likely than hijacking it. The release fixes 24 CVEs in total, 23 of them rated Low.

curl 8.12.0 - 8.22.0  -> vulnerable
curl 8.23.0            -> fixed

Why it matters: curl sits inside PHP’s curl extension, Docker builds, CI pipelines, and more or less every language’s HTTP client at some layer, so a High-severity bug in it is worth an upgrade even when the practical exploit path is narrow. If anything in your stack uploads to servers it doesn’t fully trust, over HTTP/2, that’s the scenario this patches.

The caveat: curl’s own write-up treats the RCE path as a theoretical worst case rather than something there’s a working exploit for. Most affected processes would just crash.