CVE-2026-92392
HTTP/2 upload Use-After-Free
Published Oct 14, 2026 · updated Oct 15, 2026 · Debian Debian
During an upload, curl mishandles HTTP/2 received from the server (with reason or ) leading to a use after free of a object.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
During an upload, curl mishandles HTTP/2 received from the server (with reason or ) leading to a use after free of a object.
Oct 15, 2026 · NIST NVD
Updated
During an upload, curl mishandles HTTP/2 received from the server (with reason or ) leading to a use after free of a object.
Oct 15, 2026 · NIST NVD
Updated
During an upload, curl mishandles HTTP/2 received from the server (with reason or ) leading to a use after free of a object.
Affected
- vendor curl curlversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-92392
During an upload, curl mishandles HTTP/2 received from the server (with reason or ) leading to a use after free of a object.
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-92392
Official CVE identifier
cve.org - Debian Security AdvisoriesVendor advisoryCVE-2026-92392
[SECURITY] [DSA 6558-1] curl security update
lists.debian.org - FIRST EPSSExploitation probabilityCVE-2026-92392
30-day exploitation probability 0.2%
first.org - NIST NVDVulnerability recordCVE-2026-92392
During an upload, curl mishandles HTTP/2 received from the server (with reason or ) leading to a use after free of a object.
nvd.nist.gov