The curl 8.23.0 release fixes critical vulnerability CVE-2026-92392, an HTTP/2 use-after-free flaw surfaced by Anthropic that permits remote code execution.

#curl #CVE202692392 #Cybersecurity #Anthropic #Vulnerability

OSI approved the #curl license

https://daniel.haxx.se/blog/2026/10/15/osi-approved-the-curl-license/

Just 36 hours after the previous #curl release, we are already at three pending CVE announcements queued up... 😰

The cURL CVE-2026-92392 vulnerability enables remote code execution during HTTP/2 uploads. Update to cURL 8.23.0 or disable HTTP/2 to protect systems.

#cURL #CVE202692392 #Cybersecurity #Vulnerability #InfoSec

Welcome pszemus as #curl commit author 1548: https://github.com/curl/curl/pull/23408

Si vous utilisez curl : mettez à jour immédiatement vers la 8.23.0 : +216 bugfix et failles de sécurité #curl
www.programmez.com/actualites/c...

curl 8.23.0 patches 24 vulnerabilities—HTTP proxy, .netrc, IMAP risks fixed. SMB removed. Update. #curl #Libcurl #Cybersecurity #Vulnerability #SecurityUpdate #DevOps thedailytechfeed.com/curl-8-23-0-...

A high-severity memory corruption flaw in curl and libcurl HTTP/2 uploads affects versions 8.12.0 through 8.22.0.

Version 8.23.0 is now available with a fi…

https://en.hacks.gr/sovaro-provlima-asfaleias-sto-curl-epitrepei-se-diakomistes-na-apoktisoyn-elegcho-syskeyon/

#curl #libcurl #CVE202692392

Unpatched pre-auth SQLi in WebAlliance eCommerce: one SOAP call can end in an ASPX web shell. https://intel.threadlinqs.com/threat/TL-2026-3510 #ThreatIntel #CVE_2026_108065 #curl #Rapid7

Na dann. Hoffen wir mal, der #Curl zu Shell Installer macht nichts kaputt.

A #curl audit by Aisle

https://daniel.haxx.se/blog/2026/10/14/a-curl-audit-by-aisle/

#curl 8.23.0 with Daniel Stenberg

https://youtu.be/hQ5xZ-vO8Pg

@bagder the complexity of exploiting this seems like HIGH is still being generous. Very nice read nonetheless.
#curl

The #curl release presentation is live-streamed and the stream is.... up!

https://www.twitch.tv/curlhacker

The full vulnerability report for the nasty #curl UAF problem is disclosed. It was submitted by people at Anthropic. The reproducer is a minor piece of art.

https://hackerone.com/reports/4030333

It is 0 Days since it was #useafterfree #curl #RCE

Package : curl
CVE ID : CVE-2026-92392

#adminLive

A UAF turned RCE

In the #curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as CVE-2026-92392 with the title HTTP/2 upload Use-After-Free.

https://daniel.haxx.se/blog/2026/10/14/a-uaf-turned-rce/

#curl 8.23.0

https://daniel.haxx.se/blog/2026/10/14/curl-8-23-0/

less than 24 hours to the #curl release

24 vulnerabilities fixed and corresponding CVE Ids will be announced

4 minor changes

280 bugfixes

by 83 contributors and 45 commit authors

in 42 days since the previous release...